*/
private boolean aciCheckMods(AciLDAPOperationContainer container,
LocalBackendModifyOperation operation, boolean skipAccessCheck)
throws DirectoryException
{
Entry resourceEntry = container.getResourceEntry();
DN dn = resourceEntry.getDN();
List<Modification> modifications = container.getModifications();
for (Modification m : modifications)
{
Attribute modAttr = m.getAttribute();
AttributeType modAttrType = modAttr.getAttributeType();
if (modAttrType.equals(aciType))
{
/*
* Check that the operation has modify privileges if it contains
* an "aci" attribute type.
*/
if (!operation.getClientConnection().hasPrivilege(
Privilege.MODIFY_ACL, operation))
{
Message message =
INFO_ACI_MODIFY_FAILED_PRIVILEGE.get(String
.valueOf(container.getResourceDN()), String
.valueOf(container.getClientDN()));
logError(message);
return false;
}
}
// This access check handles the case where all attributes of this
// type are being replaced or deleted. If only a subset is being
// deleted than this access check is skipped.
ModificationType modType = m.getModificationType();
if (((modType == ModificationType.DELETE) && modAttr.isEmpty())
|| ((modType == ModificationType.REPLACE)
|| (modType == ModificationType.INCREMENT)))
{
/*
* Check if we have rights to delete all values of an attribute
* type in the resource entry.
*/
if (resourceEntry.hasAttribute(modAttrType))
{
container.setCurrentAttributeType(modAttrType);
List<Attribute> attrList =
resourceEntry.getAttribute(modAttrType, modAttr
.getOptions());
if (attrList != null)
{
for (Attribute a : attrList)
{
for (AttributeValue v : a)
{
container.setCurrentAttributeValue(v);
container.setRights(ACI_WRITE_DELETE);
if (!skipAccessCheck && !accessAllowed(container))
{
return false;
}
}
}
}
}
}
if (!modAttr.isEmpty())
{
for (AttributeValue v : modAttr)
{
container.setCurrentAttributeType(modAttrType);
switch (m.getModificationType())
{
case ADD:
case REPLACE:
container.setCurrentAttributeValue(v);
container.setRights(ACI_WRITE_ADD);
if (!skipAccessCheck && !accessAllowed(container))
{
return false;
}
break;
case DELETE:
container.setCurrentAttributeValue(v);
container.setRights(ACI_WRITE_DELETE);
if (!skipAccessCheck && !accessAllowed(container))
{
return false;
}
break;
case INCREMENT:
Entry modifiedEntry = operation.getModifiedEntry();
List<Attribute> modifiedAttrs =
modifiedEntry.getAttribute(modAttrType, modAttr
.getOptions());
if (modifiedAttrs != null)
{
for (Attribute attr : modifiedAttrs)
{