Description

Call this function to determine if a user has access rights to a specified entry, attribute, or value. The function performs this check for users who request the operation that invokes this plug-in.

For example, suppose you are writing a preoperation plug-in for the add operation. You can call this function to determine if users have the proper access rights before they can add an entry to the directory.

As part of the process of determining if the user has access rights, this function does the following:

• Checks if the user requesting the operation is the root DN.

  If so, the function returns LDAP_SUCCESS. (The root DN has permission to perform any operation.)

• Gets information about the operation being requested, the connection to the client, and the backend database where directory information is stored.

  • If for some reason the function cannot determine which operation is being requested, the function returns LDAP_OPERATIONS_ERROR.

  • If no connection to a client exists— in other words, if the request for the operation was made by the server or its backend— the function returns LDAP_SUCCESS. (The server and its backend are not restricted by access control lists.)

  • If the backend database is read-only and the request is checking for write access (SLAPI_ACL_WRITE), the function returns LDAP_UNWILLING_TO_PERFORM.

  Determines if the user requesting the operation is attempting to modify his or her own entry.

  ACLs can be set up to allow users the rights to modify their own entries. The function checks for this condition.

  The caller must ensure that the backend specified in the parameter block is set prior to calling this function. For example:

  be = slapi_be_select(slapi_entry_get_sdn_const(seObjectEntry));
  if (NULL == be) {
      cleanup("backend selection failed for entry: \"%s\"\n", szObjectDN);
      slapi_send_ldap_result(pb,LDAP_NO_SUCH_OBJECT,NULL,
          "Obj not found",0,NULL);
      return(SLAPI_PLUGIN_EXTENDED_SENT_RESULT);
  }
  
  slapi_pblock_set(pb, SLAPI_BACKEND, be);
  nAccessResult =
      slapi_access_allowed(pb,seObjectEntry,"*",bval,SLAPI_ACL_DELETE);