}
ACI_LOG.debug( "Adding the entry {}", addContext.getEntry() );
// Access the principal requesting the operation, and bypass checks if it is the admin
LdapPrincipal principal = addContext.getSession().getEffectivePrincipal();
Dn principalDn = principal.getDn();
Entry serverEntry = addContext.getEntry();
Dn dn = addContext.getDn();
// bypass authz code but manage caches if operation is performed by the admin
if ( isPrincipalAnAdministrator( principalDn ) )
{
ACI_LOG.debug( "Addition done by the administartor : no check" );
next( addContext );
tupleCache.subentryAdded( dn, serverEntry );
groupCache.groupAdded( dn, serverEntry );
return;
}
// perform checks below here for all non-admin users
Entry subentry = subentryUtils.getSubentryAttributes( dn, serverEntry );
for ( Attribute attribute : serverEntry )
{
subentry.put( attribute );
}
// Assemble all the information required to make an access control decision
Set<Dn> userGroups = groupCache.getGroups( principalDn.getNormName() );
Collection<ACITuple> tuples = new HashSet<ACITuple>();
// Build the total collection of tuples to be considered for add rights
// NOTE: entryACI are NOT considered in adds (it would be a security breech)
addPerscriptiveAciTuples( addContext, tuples, dn, subentry );
addSubentryAciTuples( addContext, tuples, dn, subentry );
// check if entry scope permission is granted
AciContext entryAciCtx = new AciContext( schemaManager, addContext );
entryAciCtx.setUserGroupNames( userGroups );
entryAciCtx.setUserDn( principalDn );
entryAciCtx.setAuthenticationLevel( principal.getAuthenticationLevel() );
entryAciCtx.setEntryDn( dn );
entryAciCtx.setMicroOperations( ADD_PERMS );
entryAciCtx.setAciTuples( tuples );
entryAciCtx.setEntry( subentry );
engine.checkPermission( entryAciCtx );
// now we must check if attribute type and value scope permission is granted
for ( Attribute attribute : serverEntry )
{
for ( Value<?> value : attribute )
{
AciContext attrAciContext = new AciContext( schemaManager, addContext );
attrAciContext.setUserGroupNames( userGroups );
attrAciContext.setUserDn( principalDn );
attrAciContext.setAuthenticationLevel( principal.getAuthenticationLevel() );
attrAciContext.setEntryDn( dn );
attrAciContext.setAttributeType( attribute.getAttributeType() );
attrAciContext.setAttrValue( value );
attrAciContext.setMicroOperations( ADD_PERMS );
attrAciContext.setAciTuples( tuples );