- if ( b->a_dn_self && (val == NULL
- || value_match( &match, b->a_dn_at,
- b->a_dn_at->ad_type->sat_equality, val, &bv, &text ) )
- != LDAP_SUCCESS
- || match )
- {
- continue;
+ /* have a dnattr match. if this is a self clause then
+ * the target must also match the op dn.
+ */
+ if ( b->a_dn_self ) {
+ /* check if the target is an attribute. */
+ if ( val == NULL )
+ continue;
+ /* target is attribute, check if the attribute value
+ * is the op dn.
+ */
+ rc = value_match( &match, b->a_dn_at,
+ b->a_dn_at->ad_type->sat_equality,
+ val, &bv, &text );
+ /* on match error or no match, fail the ACL clause */
+ if (rc != LDAP_SUCCESS || match != 0 )
+ continue;