{
DN oriChildName = moveContext.getDn();
DN newParentName = moveContext.getParent();
// Access the principal requesting the operation, and bypass checks if it is the admin
ClonedServerEntry entry = moveContext.lookup( oriChildName, ByPassConstants.LOOKUP_BYPASS );
DN newName = ( DN ) newParentName.clone();
newName.add( oriChildName.get( oriChildName.size() - 1 ) );
LdapPrincipal principal = moveContext.getSession().getEffectivePrincipal();
DN principalDn = principal.getClonedName();
// bypass authz code if we are disabled
if ( !moveContext.getSession().getDirectoryService().isAccessControlEnabled() )
{
next.move( moveContext );
return;
}
protectCriticalEntries( oriChildName);
// bypass authz code but manage caches if operation is performed by the admin
if ( isPrincipalAnAdministrator( principalDn ) )
{
next.move( moveContext );
tupleCache.subentryRenamed( oriChildName, newName );
groupCache.groupRenamed( oriChildName, newName );
return;
}
Set<DN> userGroups = groupCache.getGroups( principalDn.getNormName() );
Collection<ACITuple> tuples = new HashSet<ACITuple>();
addPerscriptiveAciTuples( moveContext, tuples, oriChildName, entry.getOriginalEntry() );
addEntryAciTuples( tuples, entry );
addSubentryAciTuples( moveContext, tuples, oriChildName, entry );
engine.checkPermission( schemaManager, moveContext, userGroups, principalDn,
principal.getAuthenticationLevel(), oriChildName, null,