*/
public void add( NextInterceptor next, AddOperationContext addContext ) throws Exception
{
// Access the principal requesting the operation, and bypass checks if it is the admin
LdapPrincipal principal = addContext.getSession().getEffectivePrincipal();
LdapDN principalDn = principal.getJndiName();
ServerEntry serverEntry = addContext.getEntry();
//Attributes entry = ServerEntryUtils.toAttributesImpl( serverEntry );
LdapDN name = addContext.getDn();
// bypass authz code if we are disabled
if ( !enabled )
{
next.add( addContext );
return;
}
// bypass authz code but manage caches if operation is performed by the admin
if ( isPrincipalAnAdministrator( principalDn ) )
{
next.add( addContext );
tupleCache.subentryAdded( name, serverEntry );
groupCache.groupAdded( name, serverEntry );
return;
}
// perform checks below here for all non-admin users
SubentryInterceptor subentryInterceptor = ( SubentryInterceptor ) chain.get( SubentryInterceptor.class.getName() );
ServerEntry subentryAttrs = subentryInterceptor.getSubentryAttributes( name, serverEntry );
for ( EntryAttribute attribute:serverEntry )
{
subentryAttrs.put( attribute );
}
// Assemble all the information required to make an access control decision
Set<LdapDN> userGroups = groupCache.getGroups( principalDn.toNormName() );
Collection<ACITuple> tuples = new HashSet<ACITuple>();
// Build the total collection of tuples to be considered for add rights
// NOTE: entryACI are NOT considered in adds (it would be a security breech)
addPerscriptiveAciTuples( addContext, tuples, name, subentryAttrs );
addSubentryAciTuples( addContext, tuples, name, subentryAttrs );
// check if entry scope permission is granted
engine.checkPermission( registries, addContext, userGroups, principalDn, principal.getAuthenticationLevel(), name, null, null,
ADD_PERMS, tuples, subentryAttrs, null );
// now we must check if attribute type and value scope permission is granted
for ( EntryAttribute attribute:serverEntry )
{
for ( Value<?> value:attribute )
{
engine.checkPermission( registries, addContext, userGroups, principalDn,
principal.getAuthenticationLevel(), name, attribute.getUpId(), value,
ADD_PERMS, tuples, serverEntry, null );
}
}
// if we've gotten this far then access has been granted