Netscape DIRECTORY SERVER 6.1 - PLUG-IN Manual page 222

Functions for Access Control
LDAP_INVALID_SYNTAX
LDAP_UNWILLING_TO_PERFORM
Description
Call this function to determine if a user has access rights to modify the specified
entry. The function performs this check for users who request the operation that
invokes this plug-in.
For example, suppose you are writing a database plug-in. You can call this function
to determine if users have the proper access rights before they can add, modify, or
delete entries from the database.
As part of the process of determining if the user has access rights, the
slapi_access_allowed()
• Checks to access control for the directory is disabled (for example, if the
dse.ldif
If access control is disabled, the function returns
• For each value in each attribute specified in the
determines if the user has permissions to write to that value. (Essentially, the
function calls
right to check.)
222 Netscape Directory Server Plug-In Programmer's Guide • August 2002
function does the following:
file contains the directive
slapi_access_allowed()
If for some reason the function cannot determine which operation is being
requested, the function returns
If no connection to a client exists (in other words, if the request for the
operation was made by the server or its back-end), the function returns
. (The server and its back-end are not restricted by access
LDAP_SUCCESS
control lists.)
If the back-end database is read-only and the request is checking for write
access (
SLAPI_ACL_WRITE
LDAP_UNWILLING_TO_PERFORM
Invalid syntax was specified.
This error can occur if the ACL associated with
an entry, attribute, or value uses the wrong
syntax.
The DSA (this directory server) is unable to
perform the specified operation.
This error can occur if, for example, you are
requesting write access to a read-only database.
accesscontrol off
LDAP_SUCCESS
LDAPMod
with
SLAPI_ACL_WRITE
LDAP_OPERATIONS_ERROR
), the function returns
.
).
.
array, the function
as the access
.