slapi_acl_check_mods()

Determines if a user has the rights to perform the specified modifications on an entry.

Syntax

#include "slapi-plugin.h"
int slapi_acl_check_mods( Slapi_PBlock *pb, Slapi_Entry *e,
     LDAPMod **mods, char **errbuf );

Parameters

This function takes the following parameters:

pb

Parameter block passed into this function.

e

Entry for which you want to check the access rights.

mods

Array of LDAPMod structures that represent the modifications to be made to the entry.

errbuf

Pointer to a string containing an error message if an error occurs during the processing of this function.

Returns

Returns one of the following values:

• LDAP_SUCCESS if the user has write permission to the values in the specified attributes.

• LDAP_INSUFFICIENT_ACCESS if the user does not have write permission to the values of the specified attribute.

• If a problem occurs during processing, the function will return one of the following error codes:

LDAP_OPERATIONS_ERROR

An error occurred while executing the operation.

LDAP_INVALID_SYNTAX

Invalid syntax was specified.

This error can occur if the ACL associated with an entry, attribute, or value uses the wrong syntax.

LDAP_UNWILLING_TO_PERFORM

The DSA (this directory server) is unable to perform the specified operation.

This error can occur if, for example, you are requesting write access to a read-only database.

Description

Call this function to determine if a user has access rights to modify the specified entry. The function performs this check for users who request the operation that invokes this plug-in.

For example, if you are writing a database plug-in, you can call this function to determine if users have the proper access rights before they can add, modify, or delete entries from the database.

As part of the process of determining if the user has access rights, the function does the following:

• Checks to access control for the directory is disabled.

  If access control is disabled, the function returns LDAP_SUCCESS.

• For each value in each attribute specified in the LDAPMod array, the function determines if the user has permissions to write to that value. Specifically, the function calls slapi_access_allowed() with SLAPI_ACL_WRITE as the access right to check.

  • If for some reason the function cannot determine which operation is being requested, the function returns LDAP_OPERATIONS_ERROR.

  • If no connection to a client exists (in other words, if the request for the operation was made by the server or its backend), the function returns LDAP_SUCCESS. (The server and its backend are not restricted by access control lists.)

  • If the backend database is read-only and the request is checking for write access (SLAPI_ACL_WRITE), the function returns LDAP_UNWILLING_TO_PERFORM.

Memory Concerns

You must free the errbuf buffer by calling slapi_ch_free() when you are finished using the error message.

See Also

slapi_access_allowed()

slapi_ch_free()