Dn oldDn = moveAndRenameContext.getDn();
CoreSession session = moveAndRenameContext.getSession();
Entry entry = moveAndRenameContext.getOriginalEntry();
LdapPrincipal principal = session.getEffectivePrincipal();
Dn principalDn = principal.getDn();
Dn newDn = moveAndRenameContext.getNewDn();
// bypass authz code if we are disabled
if ( !directoryService.isAccessControlEnabled() )
{
next( moveAndRenameContext );
return;
}
protectCriticalEntries( moveAndRenameContext, oldDn );
// bypass authz code but manage caches if operation is performed by the admin
if ( isPrincipalAnAdministrator( principalDn ) )
{
next( moveAndRenameContext );
tupleCache.subentryRenamed( oldDn, newDn );
groupCache.groupRenamed( oldDn, newDn );
return;
}
Set<Dn> userGroups = groupCache.getGroups( principalDn.getNormName() );
Collection<ACITuple> tuples = new HashSet<ACITuple>();
addPerscriptiveAciTuples( moveAndRenameContext, tuples, oldDn, entry );
addEntryAciTuples( tuples, entry );
addSubentryAciTuples( moveAndRenameContext, tuples, oldDn, entry );
AciContext aciContext = new AciContext( schemaManager, moveAndRenameContext );
aciContext.setUserGroupNames( userGroups );
aciContext.setUserDn( principalDn );
aciContext.setAuthenticationLevel( principal.getAuthenticationLevel() );
aciContext.setEntryDn( oldDn );
aciContext.setMicroOperations( MOVERENAME_PERMS );
aciContext.setAciTuples( tuples );
aciContext.setEntry( entry );
engine.checkPermission( aciContext );
// Get the entry again without operational attributes
// because access control subentry operational attributes
// will not be valid at the new location.
// This will certainly be fixed by the SubentryInterceptor,
// but after this service.
LookupOperationContext lookupContext = new LookupOperationContext( session, oldDn,
SchemaConstants.ALL_USER_ATTRIBUTES_ARRAY );
Entry importedEntry = directoryService.getPartitionNexus().lookup( lookupContext );
// As the target entry does not exist yet and so
// its subentry operational attributes are not there,
// we need to construct an entry to represent it
// at least with minimal requirements which are object class
// and access control subentry operational attributes.
Entry subentryAttrs = subentryUtils.getSubentryAttributes( newDn, importedEntry );
for ( Attribute attribute : importedEntry )
{
subentryAttrs.put( attribute );
}
Collection<ACITuple> destTuples = new HashSet<ACITuple>();
// Import permission is only valid for prescriptive ACIs
addPerscriptiveAciTuples( moveAndRenameContext, destTuples, newDn, subentryAttrs );
// Evaluate the target context to see whether it
// allows an entry named newName to be imported as a subordinate.
aciContext = new AciContext( schemaManager, moveAndRenameContext );
aciContext.setUserGroupNames( userGroups );
aciContext.setUserDn( principalDn );
aciContext.setAuthenticationLevel( principal.getAuthenticationLevel() );
aciContext.setEntryDn( newDn );
aciContext.setMicroOperations( IMPORT_PERMS );
aciContext.setAciTuples( destTuples );
aciContext.setEntry( subentryAttrs );