Netscape DIRECTORY SERVER 7.0 - PLUG-IN Manual page 232

Functions for Access Control
LDAP_INVALID_SYNTAX
LDAP_UNWILLING_TO_PERFORM
Description
Call this function to determine if a user has access rights to modify the specified
entry. The function performs this check for users who request the operation that
invokes this plug-in.
Suppose you are writing a database plug-in. You can call this function to
determine if users have the proper access rights before they can add, modify, or
delete entries from the database.
As part of the process of determining if the user has access rights, the
slapi_access_allowed()
• Checks if access control for the directory is disabled (for example, if the
dse.ldif
If access control is disabled, the function returns
• For each value in each attribute specified in the
determines if the user has permissions to write to that value. Essentially, the
function calls
access right to check.
232 Netscape Directory Server Plug-in Programmer's Guide • October 2004
function does the following:
file contains the directive
slapi_access_allowed()
If for some reason the function cannot determine which operation is being
requested, the function returns
If no connection to a client exists (in other words, if the request for the
operation was made by the server or its backend), the function returns
. (The server and its backend are not restricted by access
LDAP_SUCCESS
control lists.)
If the backend database is read-only and the request is checking for write
access (
SLAPI_ACL_WRITE
LDAP_UNWILLING_TO_PERFORM
Invalid syntax was specified.
This error can occur if the ACL associated with
an entry, attribute, or value uses the wrong
syntax.
The Directory Server is unable to perform the
specified operation.
This error can occur if, for example, you are
requesting write access to a read-only database.
accesscontrol off
LDAP_SUCCESS
LDAPMod
with
SLAPI_ACL_WRITE
LDAP_OPERATIONS_ERROR
), the function returns
.
).
.
array, the function
as the
.