* First call hasPermission() for entry level "Browse" and "ReturnDN" perm
* tests. If we hasPermission() returns false we immediately short the
* process and return false.
*/
LdapPrincipal principal = opContext.getSession().getEffectivePrincipal();
DN userDn = principal.getClonedName();
Set<DN> userGroups = groupCache.getGroups( userDn.toNormName() );
Collection<ACITuple> tuples = new HashSet<ACITuple>();
addPerscriptiveAciTuples( opContext, tuples, normName, clonedEntry.getOriginalEntry() );
addEntryAciTuples( tuples, clonedEntry.getOriginalEntry() );
addSubentryAciTuples( opContext, tuples, normName, clonedEntry.getOriginalEntry() );
if ( !engine.hasPermission(
schemaManager,
opContext,
userGroups,
userDn,
principal.getAuthenticationLevel(),
normName,
null,
null,
SEARCH_ENTRY_PERMS,
tuples,
clonedEntry.getOriginalEntry(),
null ) )
{
return false;
}
/*
* For each attribute type we check if access is allowed to the type. If not
* the attribute is yanked out of the entry to be returned. If permission is
* allowed we move on to check if the values are allowed. Values that are
* not allowed are removed from the attribute. If the attribute has no more
* values remaining then the entire attribute is removed.
*/
List<AttributeType> attributeToRemove = new ArrayList<AttributeType>();
for ( AttributeType attributeType:clonedEntry.getAttributeTypes() )
{
// if attribute type scope access is not allowed then remove the attribute and continue
String id = attributeType.getName();
EntryAttribute attr = clonedEntry.get( attributeType );
if ( !engine.hasPermission(
schemaManager,
opContext,
userGroups,
userDn,
principal.getAuthenticationLevel(),
normName,
id,
null,
SEARCH_ATTRVAL_PERMS,
tuples,
clonedEntry,
null ) )
{
attributeToRemove.add( attributeType );
continue;
}
List<Value<?>> valueToRemove = new ArrayList<Value<?>>();
// attribute type scope is ok now let's determine value level scope
for ( Value<?> value:attr )
{
if ( !engine.hasPermission(
schemaManager,
opContext,
userGroups,
userDn,
principal.getAuthenticationLevel(),
normName,
attr.getUpId(),
value,
SEARCH_ATTRVAL_PERMS,
tuples,