- /* asker not listed in dnattr - check for self access */
- } else if ( ! b->a_dn_self || val == NULL
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
- /* not yet implemented */
-#else
- || value_cmp( &bv, val, at->a_syntax, 2 ) != 0
-#endif
- )
- {
- continue;
+ if( match ) {
+ /* have a dnattr match. if this is a self clause then
+ * the target must also match the op dn.
+ */
+ if ( b->a_dn_self ) {
+ /* check if the target is an attribute. */
+ if ( val == NULL )
+ continue;
+ /* target is attribute, check if the attribute value
+ * is the op dn.
+ */
+ rc = value_match( &match, b->a_dn_at,
+ b->a_dn_at->ad_type->sat_equality,
+ val, &bv, &text );
+ /* on match error or no match, fail the ACL clause */
+ if (rc != LDAP_SUCCESS || match != 0 )
+ continue;
+ }
+ } else {
+ /* no dnattr match, check if this is a self clause */
+ if ( ! b->a_dn_self )
+ continue;
+ /* this is a self clause, check if the target is an
+ * attribute.
+ */
+ if ( val == NULL )
+ continue;
+ /* target is attribute, check if the attribute value
+ * is the op dn.
+ */
+ rc = value_match( &match, b->a_dn_at,
+ b->a_dn_at->ad_type->sat_equality,
+ val, &bv, &text );
+ /* on match error or no match, fail the ACL clause */
+ if (rc != LDAP_SUCCESS || match != 0 )
+ continue;