public void add( NextInterceptor next, String upName, Name normName, Attributes entry ) throws NamingException
{
// Access the principal requesting the operation, and bypass checks if it is the admin
Invocation invocation = InvocationStack.getInstance().peek();
LdapPrincipal user = ( ( ServerContext ) invocation.getCaller() ).getPrincipal();
// bypass authz code if we are disabled
if ( ! enabled )
{
next.add( upName, normName, entry );
return;
}
// bypass authz code but manage caches if operation is performed by the admin
if ( user.getName().equalsIgnoreCase( DirectoryPartitionNexus.ADMIN_PRINCIPAL ) )
{
next.add( upName, normName, entry );
tupleCache.subentryAdded( upName, normName, entry );
groupCache.groupAdded( upName, normName, entry );
return;
}
// perform checks below here for all non-admin users
SubentryService subentryService = ( SubentryService ) chain.get( "subentryService" );
Attributes subentryAttrs = subentryService.getSubentryAttributes( normName, entry );
NamingEnumeration attrList = entry.getAll();
while( attrList.hasMore() )
{
subentryAttrs.put( ( Attribute ) attrList.next() );
}
// Assemble all the information required to make an access control decision
Set userGroups = groupCache.getGroups( user.getName() );
Collection tuples = new HashSet();
// Build the total collection of tuples to be considered for add rights
// NOTE: entryACI are NOT considered in adds (it would be a security breech)
addPerscriptiveAciTuples( invocation.getProxy(), tuples, normName, subentryAttrs );
addSubentryAciTuples( invocation.getProxy(), tuples, normName, subentryAttrs );
// check if entry scope permission is granted
DirectoryPartitionNexusProxy proxy = invocation.getProxy();
engine.checkPermission( proxy, userGroups, user.getJndiName(), user.getAuthenticationLevel(),
normName, null, null, ADD_PERMS, tuples, subentryAttrs );
// now we must check if attribute type and value scope permission is granted
NamingEnumeration attributeList = entry.getAll();
while ( attributeList.hasMore() )
{
Attribute attr = ( Attribute ) attributeList.next();
for ( int ii = 0; ii < attr.size(); ii++ )
{
engine.checkPermission( proxy, userGroups, user.getJndiName(),
user.getAuthenticationLevel(), normName, attr.getID(),
attr.get( ii ), ADD_PERMS, tuples, entry );
}
}
// if we've gotten this far then access has been granted