// Check that the removed AdministrativeRole is valid
if ( !ROLES.contains( roleStr ) )
{
String message = "Cannot delete the given role, it's not a valid one :" + role;
LOG.error( message );
throw new LdapUnwillingToPerformException( message );
}
// Now we are trying to delete an Administrative point. We have to check that
// we only have one role if the deleted role is an AAP
if ( isAutonomousAreaRole( roleStr ) )
{
// We know have to check that removing the AAP, we will not
// left any pending IAP. We should check for the 3 potential IAPs :
// AccessControl, CollectiveAttribute and TriggerExecution.
// If the removed AP has a parent, no need to go any further :
// the children IAPs will depend on this parent.
// Process the ACs
DnNode<AccessControlAdministrativePoint> acAps = directoryService.getAccessControlAPCache();
if ( !acAps.hasParent( dn ) )
{
// No parent, check for any IAP
List<AccessControlAdministrativePoint> children = acAps.getDescendantElements( dn );
for ( AccessControlAdministrativePoint child : children )
{
if ( child.isInner() )
{
// Ok, we are dead : the IAP will remain with no parent.
String message = "Cannot delete the given role, the " + child.getDn()
+ " AccessControl IAP will remain orphan";
LOG.error( message );
throw new LdapUnwillingToPerformException( message );
}
}
}
// Process the CAs
DnNode<CollectiveAttributeAdministrativePoint> caAps = directoryService.getCollectiveAttributeAPCache();
if ( !acAps.hasParent( dn ) )
{
// No parent, check for any IAP
List<CollectiveAttributeAdministrativePoint> children = caAps.getDescendantElements( dn );
for ( CollectiveAttributeAdministrativePoint child : children )
{
if ( child.isInner() )
{
// Ok, we are dead : the IAP will remain with no parent.
String message = "Cannot delete the given role, the " + child.getDn()
+ " CollectiveAttribute IAP will remain orphan";
LOG.error( message );
throw new LdapUnwillingToPerformException( message );
}
}
}
// Process the TEs
DnNode<TriggerExecutionAdministrativePoint> teAps = directoryService.getTriggerExecutionAPCache();
if ( !acAps.hasParent( dn ) )
{
// No parent, check for any IAP
List<TriggerExecutionAdministrativePoint> children = teAps.getDescendantElements( dn );
for ( TriggerExecutionAdministrativePoint child : children )
{
if ( child.isInner() )
{
// Ok, we are dead : the IAP will remain with no parent.
String message = "Cannot delete the given role, the " + child.getDn()
+ " TriggerExecution IAP will remain orphan";
LOG.error( message );
throw new LdapUnwillingToPerformException( message );
}
}
}
}
}