Adding upstream version 2:4.17.12+dfsg.upstream/2%4.17.12+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1477 insertions, 0 deletions

diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
new file mode 100644
index 0000000..5b97c9d
--- /dev/null
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -0,0 +1,1477 @@
+/* 
+   ldb database library
+
+   Copyright (C) Simo Sorce  2006-2008
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
+   Copyright (C) Matthias Dieter Wallnöfer 2010-2011
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/*
+ *  Name: ldb
+ *
+ *  Component: objectClass sorting and constraint checking module
+ *
+ *  Description: 
+ *  - sort the objectClass attribute into the class
+ *    hierarchy and perform constraint checks (correct RDN name,
+ *    valid parent),
+ *  - fix DNs into 'standard' case
+ *  - Add objectCategory and some other attribute defaults
+ *
+ *  Author: Andrew Bartlett
+ */
+
+
+#include "includes.h"
+#include "ldb_module.h"
+#include "dsdb/samdb/samdb.h"
+#include "librpc/ndr/libndr.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "libcli/security/security.h"
+#include "auth/auth.h"
+#include "param/param.h"
+#include "../libds/common/flags.h"
+#include "dsdb/samdb/ldb_modules/util.h"
+
+#undef strcasecmp
+
+struct oc_context {
+
+	struct ldb_module *module;
+	struct ldb_request *req;
+	const struct dsdb_schema *schema;
+
+	struct ldb_reply *search_res;
+	struct ldb_reply *search_res2;
+
+	int (*step_fn)(struct oc_context *);
+};
+
+static struct oc_context *oc_init_context(struct ldb_module *module,
+					  struct ldb_request *req)
+{
+	struct ldb_context *ldb;
+	struct oc_context *ac;
+
+	ldb = ldb_module_get_ctx(module);
+
+	ac = talloc_zero(req, struct oc_context);
+	if (ac == NULL) {
+		ldb_oom(ldb);
+		return NULL;
+	}
+
+	ac->module = module;
+	ac->req = req;
+	ac->schema = dsdb_get_schema(ldb, ac);
+
+	return ac;
+}
+
+static int objectclass_do_add(struct oc_context *ac);
+
+/*
+ * This checks if we have unrelated object classes in our entry's "objectClass"
+ * attribute. That means "unsatisfied" abstract classes (no concrete subclass)
+ * or two or more disjunct structural ones.
+ * If one of these conditions are true, blame.
+ */
+static int check_unrelated_objectclasses(struct ldb_module *module,
+					const struct dsdb_schema *schema,
+					const struct dsdb_class *struct_objectclass,
+					struct ldb_message_element *objectclass_element)
+{
+	struct ldb_context *ldb = ldb_module_get_ctx(module);
+	unsigned int i;
+	bool found;
+
+	if (schema == NULL) {
+		return LDB_SUCCESS;
+	}
+
+	for (i = 0; i < objectclass_element->num_values; i++) {
+		const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema,
+											   &objectclass_element->values[i]);
+		const struct dsdb_class *tmp_class2 = struct_objectclass;
+
+		/* Pointer comparison can be used due to the same schema str. */
+		if (tmp_class == NULL ||
+		    tmp_class == struct_objectclass ||
+		    tmp_class->objectClassCategory > 2 ||
+		    ldb_attr_cmp(tmp_class->lDAPDisplayName, "top") == 0) {
+			continue;
+		}
+
+		found = false;
+		while (!found &&
+		       ldb_attr_cmp(tmp_class2->lDAPDisplayName, "top") != 0) {
+			tmp_class2 = dsdb_class_by_lDAPDisplayName(schema,
+								   tmp_class2->subClassOf);
+			if (tmp_class2 == tmp_class) {
+				found = true;
+			}
+		}
+		if (found) {
+			continue;
+		}
+
+		ldb_asprintf_errstring(ldb,
+				       "objectclass: the objectclass '%s' seems to be unrelated to %s!",
+				       tmp_class->lDAPDisplayName,
+				       struct_objectclass->lDAPDisplayName);
+		return LDB_ERR_OBJECT_CLASS_VIOLATION;
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
+{
+	struct ldb_context *ldb;
+	struct oc_context *ac;
+	int ret;
+
+	ac = talloc_get_type(req->context, struct oc_context);
+	ldb = ldb_module_get_ctx(ac->module);
+
+	if (!ares) {
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_OPERATIONS_ERROR);
+	}
+	if (ares->error != LDB_SUCCESS &&
+	    ares->error != LDB_ERR_NO_SUCH_OBJECT) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+	}
+
+	ldb_reset_err_string(ldb);
+
+	switch (ares->type) {
+	case LDB_REPLY_ENTRY:
+		if (ac->search_res != NULL) {
+			ldb_set_errstring(ldb, "Too many results");
+			talloc_free(ares);
+			return ldb_module_done(ac->req, NULL, NULL,
+						LDB_ERR_OPERATIONS_ERROR);
+		}
+
+		ac->search_res = talloc_steal(ac, ares);
+		break;
+
+	case LDB_REPLY_REFERRAL:
+		/* ignore */
+		talloc_free(ares);
+		break;
+
+	case LDB_REPLY_DONE:
+		talloc_free(ares);
+		ret = ac->step_fn(ac);
+		if (ret != LDB_SUCCESS) {
+			return ldb_module_done(ac->req, NULL, NULL, ret);
+		}
+		break;
+	}
+
+	return LDB_SUCCESS;
+}
+
+/* Fix up the DN to be in the standard form, taking particular care to match the parent DN
+
+   This should mean that if the parent is:
+    CN=Users,DC=samba,DC=example,DC=com
+   and a proposed child is
+    cn=Admins ,cn=USERS,dc=Samba,dc=example,dc=COM
+
+   The resulting DN should be:
+
+    CN=Admins,CN=Users,DC=samba,DC=example,DC=com
+   
+ */
+static int fix_dn(struct ldb_context *ldb,
+		  TALLOC_CTX *mem_ctx,
+		  struct ldb_dn *newdn, struct ldb_dn *parent_dn, 
+		  struct ldb_dn **fixed_dn) 
+{
+	char *upper_rdn_attr;
+	const struct ldb_val *rdn_val;
+
+	/* Fix up the DN to be in the standard form, taking particular care to
+	 * match the parent DN */
+	*fixed_dn = ldb_dn_copy(mem_ctx, parent_dn);
+	if (*fixed_dn == NULL) {
+		return ldb_oom(ldb);
+	}
+
+	/* We need the attribute name in upper case */
+	upper_rdn_attr = strupper_talloc(*fixed_dn, 
+					 ldb_dn_get_rdn_name(newdn));
+	if (upper_rdn_attr == NULL) {
+		return ldb_oom(ldb);
+	}
+
+	/* Create a new child */
+	if (ldb_dn_add_child_fmt(*fixed_dn, "X=X") == false) {
+		return ldb_operr(ldb);
+	}
+
+	rdn_val = ldb_dn_get_rdn_val(newdn);
+	if (rdn_val == NULL) {
+		return ldb_operr(ldb);
+	}
+
+#if 0
+	/* the rules for rDN length constraints are more complex than
+	this. Until we understand them we need to leave this
+	constraint out. Otherwise we break replication, as windows
+	does sometimes send us rDNs longer than 64 */
+	if (!rdn_val || rdn_val->length > 64) {
+		DEBUG(2,(__location__ ": WARNING: rDN longer than 64 limit for '%s'\n", ldb_dn_get_linearized(newdn)));
+	}
+#endif
+
+
+	/* And replace it with CN=foo (we need the attribute in upper case) */
+	return ldb_dn_set_component(*fixed_dn, 0, upper_rdn_attr, *rdn_val);
+}
+
+
+static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_context *ldb;
+	struct ldb_request *search_req;
+	struct oc_context *ac;
+	struct ldb_dn *parent_dn;
+	const struct ldb_val *val;
+	int ret;
+	static const char * const parent_attrs[] = { "objectClass", NULL };
+
+	ldb = ldb_module_get_ctx(module);
+
+	ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_add\n");
+
+	/* do not manipulate our control entries */
+	if (ldb_dn_is_special(req->op.add.message->dn)) {
+		return ldb_next_request(module, req);
+	}
+
+	/* An add operation on the basedn without "NC-add" operation isn't
+	 * allowed. */
+	if (ldb_dn_compare(ldb_get_default_basedn(ldb), req->op.add.message->dn) == 0) {
+		unsigned int instanceType;
+
+		instanceType = ldb_msg_find_attr_as_uint(req->op.add.message,
+							 "instanceType", 0);
+		if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
+			char *referral_uri;
+			/* When we are trying to readd the root basedn then
+			 * this is denied, but with an interesting mechanism:
+			 * there is generated a referral with the last
+			 * component value as hostname. */
+			val = ldb_dn_get_component_val(req->op.add.message->dn,
+						       ldb_dn_get_comp_num(req->op.add.message->dn) - 1);
+			if (val == NULL) {
+				return ldb_operr(ldb);
+			}
+			referral_uri = talloc_asprintf(req, "ldap://%s/%s", val->data,
+						       ldb_dn_get_linearized(req->op.add.message->dn));
+			if (referral_uri == NULL) {
+				return ldb_module_oom(module);
+			}
+
+			return ldb_module_send_referral(req, referral_uri);
+		}
+	}
+
+	ac = oc_init_context(module, req);
+	if (ac == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	/* If there isn't a parent, just go on to the add processing */
+	if (ldb_dn_get_comp_num(ac->req->op.add.message->dn) == 1) {
+		return objectclass_do_add(ac);
+	}
+
+	/* get copy of parent DN */
+	parent_dn = ldb_dn_get_parent(ac, ac->req->op.add.message->dn);
+	if (parent_dn == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	ret = ldb_build_search_req(&search_req, ldb,
+				   ac, parent_dn, LDB_SCOPE_BASE,
+				   "(objectClass=*)", parent_attrs,
+				   NULL,
+				   ac, get_search_callback,
+				   req);
+	LDB_REQ_SET_LOCATION(search_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ret = dsdb_request_add_controls(search_req,
+					DSDB_FLAG_AS_SYSTEM |
+					DSDB_SEARCH_SHOW_RECYCLED);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ac->step_fn = objectclass_do_add;
+
+	return ldb_next_request(ac->module, search_req);
+}
+
+
+/*
+  check if this is a special RODC nTDSDSA add
+ */
+static bool check_rodc_ntdsdsa_add(struct oc_context *ac,
+				   const struct dsdb_class *objectclass)
+{
+	struct ldb_control *rodc_control;
+
+	if (ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) {
+		return false;
+	}
+	rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID);
+	if (!rodc_control) {
+		return false;
+	}
+
+	rodc_control->critical = false;
+	return true;
+}
+
+static int objectclass_do_add(struct oc_context *ac)
+{
+	struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+	struct ldb_request *add_req;
+	struct ldb_message_element *objectclass_element, *el;
+	struct ldb_message *msg;
+	const char *rdn_name = NULL;
+	char *value;
+	const struct dsdb_class *objectclass;
+	struct ldb_dn *objectcategory;
+	int32_t systemFlags = 0;
+	unsigned int i, j;
+	bool found;
+	int ret;
+
+	msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
+	if (msg == NULL) {
+		return ldb_module_oom(ac->module);
+	}
+
+	/* Check if we have a valid parent - this check is needed since
+	 * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
+	if (ac->search_res == NULL) {
+		unsigned int instanceType;
+
+		/* An add operation on partition DNs without "NC-add" operation
+		 * isn't allowed. */
+		instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType",
+							 0);
+		if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
+			ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not exist!", 
+					       ldb_dn_get_linearized(msg->dn));
+			return LDB_ERR_NO_SUCH_OBJECT;
+		}
+
+		/* Don't keep any error messages - we've to add a partition */
+		ldb_set_errstring(ldb, NULL);
+	} else {
+		/* Fix up the DN to be in the standard form, taking
+		 * particular care to match the parent DN */
+		ret = fix_dn(ldb, msg,
+			     ac->req->op.add.message->dn,
+			     ac->search_res->message->dn,
+			     &msg->dn);
+		if (ret != LDB_SUCCESS) {
+			ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
+					       ldb_dn_get_linearized(ac->req->op.add.message->dn));
+			return ret;
+		}
+	}
+
+	if (ac->schema != NULL) {
+		unsigned int linkID = 0;
+		/*
+		 * Notice: by the normalization function call in "ldb_request()"
+		 * case "LDB_ADD" we have always only *one* "objectClass"
+		 * attribute at this stage!
+		 */
+
+		objectclass_element = ldb_msg_find_element(msg, "objectClass");
+		if (!objectclass_element) {
+			ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, no objectclass specified!",
+					       ldb_dn_get_linearized(msg->dn));
+			return LDB_ERR_OBJECT_CLASS_VIOLATION;
+		}
+		if (objectclass_element->num_values == 0) {
+			ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, at least one (structural) objectclass has to be specified!",
+					       ldb_dn_get_linearized(msg->dn));
+			return LDB_ERR_CONSTRAINT_VIOLATION;
+		}
+
+		/* Now do the sorting */
+		ret = dsdb_sort_objectClass_attr(ldb, ac->schema,
+						 objectclass_element, msg,
+						 objectclass_element);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+
+		/*
+		 * Get the new top-most structural object class and check for
+		 * unrelated structural classes
+		 */
+		objectclass = dsdb_get_last_structural_class(ac->schema,
+							     objectclass_element);
+		if (objectclass == NULL) {
+			ldb_asprintf_errstring(ldb,
+					       "Failed to find a structural class for %s",
+					       ldb_dn_get_linearized(msg->dn));
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		}
+
+		ret = check_unrelated_objectclasses(ac->module, ac->schema,
+						    objectclass,
+						    objectclass_element);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+
+		rdn_name = ldb_dn_get_rdn_name(msg->dn);
+		if (rdn_name == NULL) {
+			return ldb_operr(ldb);
+		}
+		found = false;
+		for (i = 0; (!found) && (i < objectclass_element->num_values);
+		     i++) {
+			const struct dsdb_class *tmp_class =
+				dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
+								      &objectclass_element->values[i]);
+
+			if (tmp_class == NULL) continue;
+
+			if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
+				found = true;
+		}
+		if (!found) {
+			ldb_asprintf_errstring(ldb,
+					       "objectclass: Invalid RDN '%s' for objectclass '%s'!",
+					       rdn_name, objectclass->lDAPDisplayName);
+			return LDB_ERR_NAMING_VIOLATION;
+		}
+
+		if (objectclass->systemOnly &&
+		    !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
+		    !check_rodc_ntdsdsa_add(ac, objectclass)) {
+			ldb_asprintf_errstring(ldb,
+					       "objectclass: object class '%s' is system-only, rejecting creation of '%s'!",
+					       objectclass->lDAPDisplayName,
+					       ldb_dn_get_linearized(msg->dn));
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		}
+
+		if (ac->search_res && ac->search_res->message) {
+			struct ldb_message_element *oc_el
+				= ldb_msg_find_element(ac->search_res->message, "objectClass");
+
+			bool allowed_class = false;
+			for (i=0; allowed_class == false && oc_el && i < oc_el->num_values; i++) {
+				const struct dsdb_class *sclass;
+
+				sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
+									       &oc_el->values[i]);
+				if (!sclass) {
+					/* We don't know this class?  what is going on? */
+					continue;
+				}
+				for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
+					if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
+						allowed_class = true;
+						break;
+					}
+				}
+			}
+
+			if (!allowed_class) {
+				ldb_asprintf_errstring(ldb, "structural objectClass %s is not a valid child class for %s",
+						objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res->message->dn));
+				return LDB_ERR_NAMING_VIOLATION;
+			}
+		}
+
+		objectcategory = ldb_msg_find_attr_as_dn(ldb, ac, msg,
+							 "objectCategory");
+		if (objectcategory == NULL) {
+			struct dsdb_extended_dn_store_format *dn_format =
+					talloc_get_type(ldb_module_get_private(ac->module),
+							struct dsdb_extended_dn_store_format);
+			if (dn_format && dn_format->store_extended_dn_in_ldb == false) {
+				/* Strip off extended components */
+				struct ldb_dn *dn = ldb_dn_new(ac, ldb,
+							       objectclass->defaultObjectCategory);
+				value = ldb_dn_alloc_linearized(msg, dn);
+				talloc_free(dn);
+			} else {
+				value = talloc_strdup(msg,
+						      objectclass->defaultObjectCategory);
+			}
+			if (value == NULL) {
+				return ldb_module_oom(ac->module);
+			}
+
+			ret = ldb_msg_add_string(msg, "objectCategory", value);
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+		} else {
+			const struct dsdb_class *ocClass =
+					dsdb_class_by_cn_ldb_val(ac->schema,
+								 ldb_dn_get_rdn_val(objectcategory));
+			if (ocClass != NULL) {
+				struct ldb_dn *dn = ldb_dn_new(ac, ldb,
+							       ocClass->defaultObjectCategory);
+				if (ldb_dn_compare(objectcategory, dn) != 0) {
+					ocClass = NULL;
+				}
+			}
+			talloc_free(objectcategory);
+			if (ocClass == NULL) {
+				ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'objectCategory' attribute invalid!",
+						       ldb_dn_get_linearized(msg->dn));
+				return LDB_ERR_OBJECT_CLASS_VIOLATION;
+			}
+		}
+
+		if (!ldb_msg_find_element(msg, "showInAdvancedViewOnly") && (objectclass->defaultHidingValue == true)) {
+			ldb_msg_add_string(msg, "showInAdvancedViewOnly",
+						"TRUE");
+		}
+
+		/* There are very special rules for systemFlags, see MS-ADTS
+		 * MS-ADTS 3.1.1.5.2.4 */
+
+		el = ldb_msg_find_element(msg, "systemFlags");
+		if ((el != NULL) && (el->num_values > 1)) {
+			ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'systemFlags' attribute multivalued!",
+					       ldb_dn_get_linearized(msg->dn));
+			return LDB_ERR_CONSTRAINT_VIOLATION;
+		}
+
+		systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
+
+		ldb_msg_remove_attr(msg, "systemFlags");
+
+		/* Only the following flags may be set by a client */
+		if (ldb_request_get_control(ac->req,
+					    LDB_CONTROL_RELAX_OID) == NULL) {
+			systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME
+				       | SYSTEM_FLAG_CONFIG_ALLOW_MOVE
+				       | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
+				       | SYSTEM_FLAG_ATTR_IS_RDN );
+		}
+
+		/* But the last one ("ATTR_IS_RDN") is only allowed on
+		 * "attributeSchema" objects. So truncate if it does not fit. */
+		if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") != 0) {
+			systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
+		}
+
+		if (ldb_attr_cmp(objectclass->lDAPDisplayName, "server") == 0) {
+			systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE | SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
+		} else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "site") == 0
+				|| ldb_attr_cmp(objectclass->lDAPDisplayName, "serversContainer") == 0
+				|| ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSDSA") == 0) {
+			if (ldb_attr_cmp(objectclass->lDAPDisplayName, "site") == 0)
+				systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
+			systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
+		} else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLink") == 0
+				|| ldb_attr_cmp(objectclass->lDAPDisplayName, "subnet") == 0
+				|| ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLinkBridge") == 0
+				|| ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSConnection") == 0) {
+			systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
+		}
+		/* TODO: If parent object is site or subnet, also add (SYSTEM_FLAG_CONFIG_ALLOW_RENAME) */
+
+		linkID = ldb_msg_find_attr_as_int(msg, "linkID", 0);
+		if (linkID > 0 && linkID % 2 == 1) {
+			systemFlags |= DS_FLAG_ATTR_NOT_REPLICATED;
+		}
+
+		if (el || systemFlags != 0) {
+			ret = samdb_msg_add_int(ldb, msg, msg, "systemFlags",
+						systemFlags);
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+		}
+
+		/* make sure that "isCriticalSystemObject" is not specified! */
+		el = ldb_msg_find_element(msg, "isCriticalSystemObject");
+		if ((el != NULL) &&
+                    !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
+			ldb_set_errstring(ldb,
+					  "objectclass: 'isCriticalSystemObject' must not be specified!");
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		}
+	}
+
+	ret = ldb_build_add_req(&add_req, ldb, ac,
+				msg,
+				ac->req->controls,
+				ac->req, dsdb_next_callback,
+				ac->req);
+	LDB_REQ_SET_LOCATION(add_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	/* perform the add */
+	return ldb_next_request(ac->module, add_req);
+}
+
+static int oc_modify_callback(struct ldb_request *req,
+				struct ldb_reply *ares);
+static int objectclass_do_mod(struct oc_context *ac);
+
+static int objectclass_modify(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_context *ldb = ldb_module_get_ctx(module);
+	struct ldb_message_element *objectclass_element;
+	struct ldb_message *msg;
+	struct ldb_request *down_req;
+	struct oc_context *ac;
+	bool oc_changes = false;
+	int ret;
+
+	ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_modify\n");
+
+	/* do not manipulate our control entries */
+	if (ldb_dn_is_special(req->op.mod.message->dn)) {
+		return ldb_next_request(module, req);
+	}
+
+	/* As with the "real" AD we don't accept empty messages */
+	if (req->op.mod.message->num_elements == 0) {
+		ldb_set_errstring(ldb, "objectclass: modify message must have "
+				       "elements/attributes!");
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	ac = oc_init_context(module, req);
+	if (ac == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	/* Without schema, there isn't much to do here */
+	if (ac->schema == NULL) {
+		talloc_free(ac);
+		return ldb_next_request(module, req);
+	}
+
+	msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
+	if (msg == NULL) {
+		return ldb_module_oom(ac->module);
+	}
+
+	/* For now change everything except the objectclasses */
+
+	objectclass_element = ldb_msg_find_element(msg, "objectClass");
+	if (objectclass_element != NULL) {
+		ldb_msg_remove_attr(msg, "objectClass");
+		oc_changes = true;
+	}
+
+	/* MS-ADTS 3.1.1.5.3.5 - on a forest level < 2003 we do allow updates
+	 * only on application NCs - not on the default ones */
+	if (oc_changes &&
+	    (dsdb_forest_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003)) {
+		struct ldb_dn *nc_root;
+
+		ret = dsdb_find_nc_root(ldb, ac, req->op.mod.message->dn,
+					&nc_root);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+
+		if ((ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) ||
+		    (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) ||
+		    (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0)) {
+			ldb_set_errstring(ldb,
+					  "objectclass: object class changes on objects under the standard name contexts not allowed!");
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		}
+
+		talloc_free(nc_root);
+	}
+
+	if (oc_changes) {
+		ret = ldb_build_mod_req(&down_req, ldb, ac,
+					msg,
+					req->controls, ac,
+					oc_modify_callback,
+					req);
+	} else {
+		ret = ldb_build_mod_req(&down_req, ldb, ac,
+					msg,
+					req->controls, req,
+					dsdb_next_callback,
+					req);
+	}
+	LDB_REQ_SET_LOCATION(down_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	return ldb_next_request(module, down_req);
+}
+
+static int oc_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
+{
+	static const char * const attrs[] = { "objectClass", NULL };
+	struct ldb_context *ldb;
+	struct ldb_request *search_req;
+	struct oc_context *ac;
+	int ret;
+
+	ac = talloc_get_type(req->context, struct oc_context);
+	ldb = ldb_module_get_ctx(ac->module);
+
+	if (!ares) {
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_OPERATIONS_ERROR);
+	}
+
+	if (ares->type == LDB_REPLY_REFERRAL) {
+		return ldb_module_send_referral(ac->req, ares->referral);
+	}
+
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+	}
+
+	if (ares->type != LDB_REPLY_DONE) {
+		talloc_free(ares);
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_OPERATIONS_ERROR);
+	}
+
+	talloc_free(ares);
+
+	/* this looks up the real existing object for fetching some important
+	 * information (objectclasses) */
+	ret = ldb_build_search_req(&search_req, ldb,
+				   ac, ac->req->op.mod.message->dn,
+				   LDB_SCOPE_BASE,
+				   "(objectClass=*)",
+				   attrs, NULL, 
+				   ac, get_search_callback,
+				   ac->req);
+	LDB_REQ_SET_LOCATION(search_req);
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+	}
+
+	ret = dsdb_request_add_controls(search_req,
+					DSDB_FLAG_AS_SYSTEM |
+					DSDB_SEARCH_SHOW_RECYCLED);
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+	}
+
+	ac->step_fn = objectclass_do_mod;
+
+	ret = ldb_next_request(ac->module, search_req);
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int objectclass_do_mod(struct oc_context *ac)
+{
+	struct ldb_context *ldb;
+	struct ldb_request *mod_req;
+	struct ldb_message_element *oc_el_entry, *oc_el_change;
+	struct ldb_val *vals;
+	struct ldb_message *msg;
+	const struct dsdb_class *current_structural_objectclass;
+	const struct dsdb_class *objectclass;
+	unsigned int i, j, k;
+	bool found;
+	int ret;
+
+	ldb = ldb_module_get_ctx(ac->module);
+
+	/* we should always have a valid entry when we enter here */
+	if (ac->search_res == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	oc_el_entry = ldb_msg_find_element(ac->search_res->message,
+					   "objectClass");
+	if (oc_el_entry == NULL) {
+		/* existing entry without a valid object class? */
+		return ldb_operr(ldb);
+	}
+
+	/*
+	 * Get the current new top-most structural object class
+	 *
+	 * We must not allow this to change
+	 */
+
+	current_structural_objectclass
+		= dsdb_get_last_structural_class(ac->schema,
+						 oc_el_entry);
+	if (current_structural_objectclass == NULL) {
+		ldb_asprintf_errstring(ldb,
+				       "objectclass: cannot find current structural objectclass on %s!",
+				       ldb_dn_get_linearized(ac->search_res->message->dn));
+		return LDB_ERR_OBJECT_CLASS_VIOLATION;
+	}
+
+	/* use a new message structure */
+	msg = ldb_msg_new(ac);
+	if (msg == NULL) {
+		return ldb_module_oom(ac->module);
+	}
+
+	msg->dn = ac->req->op.mod.message->dn;
+
+	/* We've to walk over all "objectClass" message elements */
+	for (k = 0; k < ac->req->op.mod.message->num_elements; k++) {
+		if (ldb_attr_cmp(ac->req->op.mod.message->elements[k].name,
+				 "objectClass") != 0) {
+			continue;
+		}
+
+		oc_el_change = &ac->req->op.mod.message->elements[k];
+
+		switch (oc_el_change->flags & LDB_FLAG_MOD_MASK) {
+		case LDB_FLAG_MOD_ADD:
+			/* Merge the two message elements */
+			for (i = 0; i < oc_el_change->num_values; i++) {
+				for (j = 0; j < oc_el_entry->num_values; j++) {
+					if (ldb_attr_cmp((char *)oc_el_change->values[i].data,
+							 (char *)oc_el_entry->values[j].data) == 0) {
+						ldb_asprintf_errstring(ldb,
+								       "objectclass: cannot re-add an existing objectclass: '%.*s'!",
+								       (int)oc_el_change->values[i].length,
+								       (const char *)oc_el_change->values[i].data);
+						return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
+					}
+				}
+				/* append the new object class value - code was
+				 * copied from "ldb_msg_add_value" */
+				vals = talloc_realloc(oc_el_entry, oc_el_entry->values,
+						      struct ldb_val,
+						      oc_el_entry->num_values + 1);
+				if (vals == NULL) {
+					return ldb_module_oom(ac->module);
+				}
+				oc_el_entry->values = vals;
+				oc_el_entry->values[oc_el_entry->num_values] =
+							oc_el_change->values[i];
+				++(oc_el_entry->num_values);
+			}
+
+			break;
+
+		case LDB_FLAG_MOD_REPLACE:
+			/*
+			 * In this case the new "oc_el_entry" is simply
+			 * "oc_el_change"
+			 */
+			oc_el_entry = oc_el_change;
+
+			break;
+
+		case LDB_FLAG_MOD_DELETE:
+			/* Merge the two message elements */
+			for (i = 0; i < oc_el_change->num_values; i++) {
+				found = false;
+				for (j = 0; j < oc_el_entry->num_values; j++) {
+					if (ldb_attr_cmp((char *)oc_el_change->values[i].data,
+							 (char *)oc_el_entry->values[j].data) == 0) {
+						found = true;
+						/* delete the object class value
+						 * - code was copied from
+						 * "ldb_msg_remove_element" */
+						if (j != oc_el_entry->num_values - 1) {
+							memmove(&oc_el_entry->values[j],
+								&oc_el_entry->values[j+1],
+								((oc_el_entry->num_values-1) - j)*sizeof(struct ldb_val));
+						}
+						--(oc_el_entry->num_values);
+						break;
+					}
+				}
+				if (!found) {
+					/* we cannot delete a not existing
+					 * object class */
+					ldb_asprintf_errstring(ldb,
+							       "objectclass: cannot delete this objectclass: '%.*s'!",
+							       (int)oc_el_change->values[i].length,
+							       (const char *)oc_el_change->values[i].data);
+					return LDB_ERR_NO_SUCH_ATTRIBUTE;
+				}
+			}
+
+			break;
+		}
+
+		/* Now do the sorting */
+		ret = dsdb_sort_objectClass_attr(ldb, ac->schema, oc_el_entry,
+						 msg, oc_el_entry);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+
+		/*
+		 * Get the new top-most structural object class and check for
+		 * unrelated structural classes
+		 */
+		objectclass = dsdb_get_last_structural_class(ac->schema,
+							     oc_el_entry);
+		if (objectclass == NULL) {
+			ldb_set_errstring(ldb,
+					  "objectclass: cannot delete all structural objectclasses!");
+			return LDB_ERR_OBJECT_CLASS_VIOLATION;
+		}
+
+		/*
+		 * Has (so far, we re-check for each and every
+		 * "objectclass" in the message) the structural
+		 * objectclass changed?
+		 */
+
+		if (objectclass != current_structural_objectclass) {
+			const char *dn
+				= ldb_dn_get_linearized(ac->search_res->message->dn);
+			ldb_asprintf_errstring(ldb,
+					       "objectclass: not permitted "
+					       "to change the structural "
+					       "objectClass on %s [%s] => [%s]!",
+					       dn,
+					       current_structural_objectclass->lDAPDisplayName,
+					       objectclass->lDAPDisplayName);
+			return LDB_ERR_OBJECT_CLASS_VIOLATION;
+		}
+
+		/* Check for unrelated objectclasses */
+		ret = check_unrelated_objectclasses(ac->module, ac->schema,
+						    objectclass,
+						    oc_el_entry);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
+
+	/* Now add the new object class attribute to the change message */
+	ret = ldb_msg_add(msg, oc_el_entry, LDB_FLAG_MOD_REPLACE);
+	if (ret != LDB_SUCCESS) {
+		ldb_module_oom(ac->module);
+		return ret;
+	}
+
+	/* Now we have the real and definitive change left to do */
+
+	ret = ldb_build_mod_req(&mod_req, ldb, ac,
+				msg,
+				ac->req->controls,
+				ac->req, dsdb_next_callback,
+				ac->req);
+	LDB_REQ_SET_LOCATION(mod_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	return ldb_next_request(ac->module, mod_req);
+}
+
+static int objectclass_do_rename(struct oc_context *ac);
+
+static int objectclass_rename(struct ldb_module *module, struct ldb_request *req)
+{
+	static const char * const attrs[] = { "objectClass", NULL };
+	struct ldb_context *ldb;
+	struct ldb_request *search_req;
+	struct oc_context *ac;
+	struct ldb_dn *parent_dn;
+	int ret;
+
+	ldb = ldb_module_get_ctx(module);
+
+	ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_rename\n");
+
+	/* do not manipulate our control entries */
+	if (ldb_dn_is_special(req->op.rename.olddn)) {
+		return ldb_next_request(module, req);
+	}
+
+	/*
+	 * Bypass the constraint checks when we do have the "DBCHECK" control
+	 * set, so we can force objects under the deleted objects container.
+	 */
+	if (ldb_request_get_control(req, DSDB_CONTROL_DBCHECK) != NULL) {
+		return ldb_next_request(module, req);
+	}
+
+	ac = oc_init_context(module, req);
+	if (ac == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	parent_dn = ldb_dn_get_parent(ac, req->op.rename.newdn);
+	if (parent_dn == NULL) {
+		ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, the parent DN does not exist!",
+				       ldb_dn_get_linearized(req->op.rename.olddn));
+		return LDB_ERR_NO_SUCH_OBJECT;
+	}
+
+	/* this looks up the parent object for fetching some important
+	 * information (objectclasses, DN normalisation...) */
+	ret = ldb_build_search_req(&search_req, ldb,
+				   ac, parent_dn, LDB_SCOPE_BASE,
+				   "(objectClass=*)",
+				   attrs, NULL,
+				   ac, get_search_callback,
+				   req);
+	LDB_REQ_SET_LOCATION(search_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	/* we have to add the show recycled control, as otherwise DRS
+	   deletes will be refused as we will think the target parent
+	   does not exist */
+	ret = dsdb_request_add_controls(search_req,
+					DSDB_FLAG_AS_SYSTEM |
+					DSDB_SEARCH_SHOW_RECYCLED);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ac->step_fn = objectclass_do_rename;
+
+	return ldb_next_request(ac->module, search_req);
+}
+
+static int objectclass_do_rename2(struct oc_context *ac);
+
+static int objectclass_do_rename(struct oc_context *ac)
+{
+	static const char * const attrs[] = { "objectClass", NULL };
+	struct ldb_context *ldb;
+	struct ldb_request *search_req;
+	int ret;
+
+	ldb = ldb_module_get_ctx(ac->module);
+
+	/* Check if we have a valid parent - this check is needed since
+	 * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
+	if (ac->search_res == NULL) {
+		ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, parent does not exist!",
+				       ldb_dn_get_linearized(ac->req->op.rename.olddn));
+		return LDB_ERR_OTHER;
+	}
+
+	/* now assign "search_res2" to the parent entry to have "search_res"
+	 * free for another lookup */
+	ac->search_res2 = ac->search_res;
+	ac->search_res = NULL;
+
+	/* this looks up the real existing object for fetching some important
+	 * information (objectclasses) */
+	ret = ldb_build_search_req(&search_req, ldb,
+				   ac, ac->req->op.rename.olddn,
+				   LDB_SCOPE_BASE,
+				   "(objectClass=*)",
+				   attrs, NULL,
+				   ac, get_search_callback,
+				   ac->req);
+	LDB_REQ_SET_LOCATION(search_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ret = dsdb_request_add_controls(search_req,
+					DSDB_FLAG_AS_SYSTEM |
+					DSDB_SEARCH_SHOW_RECYCLED);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ac->step_fn = objectclass_do_rename2;
+
+	return ldb_next_request(ac->module, search_req);
+}
+
+static int objectclass_do_rename2(struct oc_context *ac)
+{
+	struct ldb_context *ldb;
+	struct ldb_request *rename_req;
+	struct ldb_dn *fixed_dn;
+	int ret;
+
+	ldb = ldb_module_get_ctx(ac->module);
+
+	/* Check if we have a valid entry - this check is needed since
+	 * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
+	if (ac->search_res == NULL) {
+		ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, entry does not exist!",
+				       ldb_dn_get_linearized(ac->req->op.rename.olddn));
+		return LDB_ERR_NO_SUCH_OBJECT;
+	}
+
+	if (ac->schema != NULL) {
+		struct ldb_message_element *oc_el_entry, *oc_el_parent;
+		const struct dsdb_class *objectclass;
+		const char *rdn_name;
+		bool allowed_class = false;
+		unsigned int i, j;
+		bool found;
+
+		oc_el_entry = ldb_msg_find_element(ac->search_res->message,
+						   "objectClass");
+		if (oc_el_entry == NULL) {
+			/* existing entry without a valid object class? */
+			return ldb_operr(ldb);
+		}
+		objectclass = dsdb_get_last_structural_class(ac->schema,
+							     oc_el_entry);
+		if (objectclass == NULL) {
+			/* existing entry without a valid object class? */
+			return ldb_operr(ldb);
+		}
+
+		rdn_name = ldb_dn_get_rdn_name(ac->req->op.rename.newdn);
+		if (rdn_name == NULL) {
+			return ldb_operr(ldb);
+		}
+		found = false;
+		for (i = 0; (!found) && (i < oc_el_entry->num_values); i++) {
+			const struct dsdb_class *tmp_class =
+				dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
+								      &oc_el_entry->values[i]);
+
+			if (tmp_class == NULL) continue;
+
+			if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
+				found = true;
+		}
+		if (!found) {
+			ldb_asprintf_errstring(ldb,
+					       "objectclass: Invalid RDN '%s' for objectclass '%s'!",
+					       rdn_name, objectclass->lDAPDisplayName);
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		}
+
+		oc_el_parent = ldb_msg_find_element(ac->search_res2->message,
+						    "objectClass");
+		if (oc_el_parent == NULL) {
+			/* existing entry without a valid object class? */
+			return ldb_operr(ldb);
+		}
+
+		for (i=0; allowed_class == false && i < oc_el_parent->num_values; i++) {
+			const struct dsdb_class *sclass;
+
+			sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
+								       &oc_el_parent->values[i]);
+			if (!sclass) {
+				/* We don't know this class?  what is going on? */
+				continue;
+			}
+			for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
+				if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
+					allowed_class = true;
+					break;
+				}
+			}
+		}
+
+		if (!allowed_class) {
+			ldb_asprintf_errstring(ldb,
+					       "objectclass: structural objectClass %s is not a valid child class for %s",
+					       objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res2->message->dn));
+			return LDB_ERR_NAMING_VIOLATION;
+		}
+	}
+
+	/* Ensure we are not trying to rename it to be a child of itself */
+	if ((ldb_dn_compare_base(ac->req->op.rename.olddn,
+				 ac->req->op.rename.newdn) == 0)  &&
+	    (ldb_dn_compare(ac->req->op.rename.olddn,
+			    ac->req->op.rename.newdn) != 0)) {
+		ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s to be a child of itself",
+				       ldb_dn_get_linearized(ac->req->op.rename.olddn));
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	/* Fix up the DN to be in the standard form, taking
+	 * particular care to match the parent DN */
+	ret = fix_dn(ldb, ac,
+		     ac->req->op.rename.newdn,
+		     ac->search_res2->message->dn,
+		     &fixed_dn);
+	if (ret != LDB_SUCCESS) {
+		ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
+				       ldb_dn_get_linearized(ac->req->op.rename.newdn));
+		return ret;
+
+	}
+
+	ret = ldb_build_rename_req(&rename_req, ldb, ac,
+				   ac->req->op.rename.olddn, fixed_dn,
+				   ac->req->controls,
+				   ac->req, dsdb_next_callback,
+				   ac->req);
+	LDB_REQ_SET_LOCATION(rename_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	/* perform the rename */
+	return ldb_next_request(ac->module, rename_req);
+}
+
+static int objectclass_do_delete(struct oc_context *ac);
+
+static int objectclass_delete(struct ldb_module *module, struct ldb_request *req)
+{
+	static const char * const attrs[] = { "nCName", "objectClass",
+					      "systemFlags",
+					      "isDeleted",
+					      "isCriticalSystemObject", NULL };
+	struct ldb_context *ldb;
+	struct ldb_request *search_req;
+	struct oc_context *ac;
+	int ret;
+
+	ldb = ldb_module_get_ctx(module);
+
+	ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_delete\n");
+
+	/* do not manipulate our control entries */
+	if (ldb_dn_is_special(req->op.del.dn)) {
+		return ldb_next_request(module, req);
+	}
+
+	/* Bypass the constraint checks when we do have the "RELAX" control
+	 * set. */
+	if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID) != NULL) {
+		return ldb_next_request(module, req);
+	}
+
+	ac = oc_init_context(module, req);
+	if (ac == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	/* this looks up the entry object for fetching some important
+	 * information (object classes, system flags...) */
+	ret = ldb_build_search_req(&search_req, ldb,
+				   ac, req->op.del.dn, LDB_SCOPE_BASE,
+				   "(objectClass=*)",
+				   attrs, NULL,
+				   ac, get_search_callback,
+				   req);
+	LDB_REQ_SET_LOCATION(search_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ret = dsdb_request_add_controls(search_req,
+					DSDB_FLAG_AS_SYSTEM |
+					DSDB_SEARCH_SHOW_RECYCLED);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ac->step_fn = objectclass_do_delete;
+
+	return ldb_next_request(ac->module, search_req);
+}
+
+static int objectclass_do_delete(struct oc_context *ac)
+{
+	struct ldb_context *ldb;
+	struct ldb_dn *dn;
+	int32_t systemFlags;
+	bool isCriticalSystemObject;
+	int ret;
+
+	ldb = ldb_module_get_ctx(ac->module);
+
+	/* Check if we have a valid entry - this check is needed since
+	 * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
+	if (ac->search_res == NULL) {
+		ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, entry does not exist!",
+				       ldb_dn_get_linearized(ac->req->op.del.dn));
+		return LDB_ERR_NO_SUCH_OBJECT;
+	}
+
+	/* DC's ntDSDSA object */
+	if (ldb_dn_compare(ac->req->op.del.dn, samdb_ntds_settings_dn(ldb, ac)) == 0) {
+		ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's ntDSDSA object!",
+				       ldb_dn_get_linearized(ac->req->op.del.dn));
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	/* DC's rIDSet object */
+	/* Perform this check only when it does exist - this is needed in order
+	 * to don't let existing provisions break, and to delete . */
+	ret = samdb_rid_set_dn(ldb, ac, &dn);
+	if ((ret != LDB_SUCCESS) && (ret != LDB_ERR_NO_SUCH_ATTRIBUTE)
+	    && (ret != LDB_ERR_NO_SUCH_OBJECT)) {
+		ldb_asprintf_errstring(ldb, "objectclass: Unable to determine if %s, is this DC's rIDSet object: %s ",
+				       ldb_dn_get_linearized(ac->req->op.del.dn),
+				       ldb_errstring(ldb));
+		return ret;
+	}
+	if (ret == LDB_SUCCESS) {
+		if (ldb_dn_compare(ac->req->op.del.dn, dn) == 0) {
+			talloc_free(dn);
+			ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's rIDSet object!",
+					       ldb_dn_get_linearized(ac->req->op.del.dn));
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		}
+		talloc_free(dn);
+	}
+
+	/* Only trusted request from system account are allowed to delete
+	 * deleted objects.
+	 */
+	if (ldb_msg_check_string_attribute(ac->search_res->message, "isDeleted", "TRUE") &&
+			(ldb_req_is_untrusted(ac->req) ||
+				!dsdb_module_am_system(ac->module))) {
+		ldb_asprintf_errstring(ldb, "Delete of '%s' failed",
+						ldb_dn_get_linearized(ac->req->op.del.dn));
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	/* crossRef objects regarding config, schema and default domain NCs */
+	if (samdb_find_attribute(ldb, ac->search_res->message, "objectClass",
+				 "crossRef") != NULL) {
+		dn = ldb_msg_find_attr_as_dn(ldb, ac, ac->search_res->message,
+					     "nCName");
+		if ((ldb_dn_compare(dn, ldb_get_default_basedn(ldb)) == 0) ||
+		    (ldb_dn_compare(dn, ldb_get_config_basedn(ldb)) == 0)) {
+			talloc_free(dn);
+
+			ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the main or configuration partition!",
+					       ldb_dn_get_linearized(ac->req->op.del.dn));
+			return LDB_ERR_NOT_ALLOWED_ON_NON_LEAF;
+		}
+		if (ldb_dn_compare(dn, ldb_get_schema_basedn(ldb)) == 0) {
+			talloc_free(dn);
+
+			ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the schema partition!",
+					       ldb_dn_get_linearized(ac->req->op.del.dn));
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		}
+		talloc_free(dn);
+	}
+
+	/* systemFlags */
+
+	systemFlags = ldb_msg_find_attr_as_int(ac->search_res->message,
+					       "systemFlags", 0);
+	if ((systemFlags & SYSTEM_FLAG_DISALLOW_DELETE) != 0) {
+		ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it isn't permitted!",
+				       ldb_dn_get_linearized(ac->req->op.del.dn));
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	/* isCriticalSystemObject - but this only applies on tree delete
+	 * operations - MS-ADTS 3.1.1.5.5.7.2 */
+	if (ldb_request_get_control(ac->req, LDB_CONTROL_TREE_DELETE_OID) != NULL) {
+		isCriticalSystemObject = ldb_msg_find_attr_as_bool(ac->search_res->message,
+								   "isCriticalSystemObject", false);
+		if (isCriticalSystemObject) {
+			/*
+			 * Following the explaination from Microsoft
+			 * https://lists.samba.org/archive/cifs-protocol/2011-August/002046.html
+			 * "I finished the investigation on this behavior.
+			 * As per MS-ADTS 3.1.5.5.7.2 , when a tree deletion is performed ,
+			 * every object in the tree will be checked to see if it has isCriticalSystemObject
+			 * set to TRUE, including the root node on which the delete operation is performed
+			 * But there is an exception  if the root object is a SAM specific objects(3.1.1.5.2.3 MS-ADTS)
+			 * Its deletion is done through SAM manger and isCriticalSystemObject attribute is not checked
+			 * The root node of the tree delete in your case is CN=ARES,OU=Domain Controllers,DC=w2k8r2,DC=home,DC=matws,DC=net
+			 * which is a SAM object  with  user class.  Therefore the tree deletion is performed without any error
+			 */
+
+			if (samdb_find_attribute(ldb, ac->search_res->message, "objectClass", "group") == NULL &&
+			    samdb_find_attribute(ldb, ac->search_res->message, "objectClass", "samDomain") == NULL &&
+			    samdb_find_attribute(ldb, ac->search_res->message, "objectClass", "samServer") == NULL &&
+			    samdb_find_attribute(ldb, ac->search_res->message, "objectClass", "user") == NULL) {
+					ldb_asprintf_errstring(ldb,
+					       "objectclass: Cannot tree-delete %s, it's a critical system object!",
+					       ldb_dn_get_linearized(ac->req->op.del.dn));
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+			}
+		}
+	}
+
+	return ldb_next_request(ac->module, ac->req);
+}
+
+static int objectclass_init(struct ldb_module *module)
+{
+	struct ldb_context *ldb = ldb_module_get_ctx(module);
+	int ret;
+
+	/* Init everything else */
+	ret = ldb_next_init(module);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+	
+	/* Look for the opaque to indicate we might have to cut down the DN of defaultObjectCategory */
+	ldb_module_set_private(module, ldb_get_opaque(ldb, DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME));
+
+	ret = ldb_mod_register_control(module, LDB_CONTROL_RODC_DCPROMO_OID);
+	if (ret != LDB_SUCCESS) {
+		ldb_debug(ldb, LDB_DEBUG_ERROR,
+			  "objectclass_init: Unable to register control DCPROMO with rootdse\n");
+		return ldb_operr(ldb);
+	}
+
+	return ret;
+}
+
+static const struct ldb_module_ops ldb_objectclass_module_ops = {
+	.name		= "objectclass",
+	.add		= objectclass_add,
+	.modify		= objectclass_modify,
+	.rename		= objectclass_rename,
+	.del		= objectclass_delete,
+	.init_context	= objectclass_init
+};
+
+int ldb_objectclass_module_init(const char *version)
+{
+	LDB_MODULE_CHECK_VERSION(version);
+	return ldb_register_module(&ldb_objectclass_module_ops);
+}