]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-sql/add.c
ITS#3576 use actual backend (not glue instance) for restriction and
[openldap] / servers / slapd / back-sql / add.c
index b782ba44ea72986972ea0cdaa774bb33fecf47d9..1e46866dd826daaa56582f299cb6f33e0e7ba12d 100644 (file)
@@ -1,8 +1,10 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2004 The OpenLDAP Foundation.
+ * Copyright 1999-2005 The OpenLDAP Foundation.
  * Portions Copyright 1999 Dmitry Kovalev.
+ * Portions Copyright 2002 Pierangelo Masarati.
+ * Portions Copyright 2004 Mark Adamson.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -15,7 +17,9 @@
  */
 /* ACKNOWLEDGEMENTS:
  * This work was initially developed by Dmitry Kovalev for inclusion
- * by OpenLDAP Software.
+ * by OpenLDAP Software.  Additional significant contributors include
+ * Pierangelo Masarati and Mark Adamson.
+
  */
 
 #include "portable.h"
  * - operational attributes
  * - empty attributes
  */
+#define backsql_opattr_skip(ad) \
+       (is_at_operational( (ad)->ad_type ) && (ad) != slap_schema.si_ad_ref )
 #define        backsql_attr_skip(ad, vals) \
        ( \
                ( (ad) == slap_schema.si_ad_objectClass \
                                && (vals) && BER_BVISNULL( &((vals)[ 1 ]) ) ) \
-               || is_at_operational( (ad)->ad_type ) \
+               || backsql_opattr_skip( (ad) ) \
                || ( (vals) && BER_BVISNULL( &((vals)[ 0 ]) ) ) \
        )
 
@@ -261,7 +267,7 @@ backsql_modify_delete_all_values(
                                        /* SQL procedure executed fine 
                                         * but returned an error */
                                        rs->sr_err = BACKSQL_SANITIZE_ERROR( prc );
-                                       rs->sr_text = op->oq_add.rs_e->e_name.bv_val;
+                                       rs->sr_text = op->ora_e->e_name.bv_val;
                                        SQLFreeStmt( sth, SQL_DROP );
                                        return rs->sr_err;
 
@@ -271,7 +277,7 @@ backsql_modify_delete_all_values(
                                        if ( BACKSQL_FAIL_IF_NO_MAPPING( bi ) ) 
                                        {
                                                rs->sr_err = LDAP_OTHER;
-                                               rs->sr_text = op->oq_add.rs_e->e_name.bv_val;
+                                               rs->sr_text = op->ora_e->e_name.bv_val;
                                                SQLFreeStmt( sth, SQL_DROP );
                                                return rs->sr_err;
                                        }
@@ -312,7 +318,7 @@ backsql_modify_internal(
 #if 0
                /* NOTE: some day we'll have to pass 
                 * the normalized values as well */
-               BerVarray               nvalues;
+               BerVarray               sm_nvalues;
 #endif
                backsql_at_map_rec      *at = NULL;
                struct berval           *at_val;
@@ -402,7 +408,7 @@ backsql_modify_internal(
 
                                goto add_only;
                        }
-                       
+
 del_all:
                        rs->sr_err = backsql_modify_delete_all_values( op, rs, dbh, e_id, at );
                        if ( rs->sr_err != LDAP_SUCCESS ) {
@@ -763,7 +769,7 @@ backsql_add_attr(
                Debug( LDAP_DEBUG_TRACE, "   backsql_add_attr(\"%s\"): "
                        "attribute \"%s\" is not registered "
                        "in objectclass \"%s\"\n",
-                       op->oq_add.rs_e->e_name.bv_val,
+                       op->ora_e->e_name.bv_val,
                        at->a_desc->ad_cname.bv_val,
                        BACKSQL_OC_NAME( oc ) );
 
@@ -781,7 +787,7 @@ backsql_add_attr(
                        "add procedure is not defined "
                        "for attribute \"%s\" "
                        "of structuralObjectClass \"%s\"\n",
-                       op->oq_add.rs_e->e_name.bv_val,
+                       op->ora_e->e_name.bv_val,
                        at->a_desc->ad_cname.bv_val,
                        BACKSQL_OC_NAME( oc ) );
 
@@ -901,7 +907,7 @@ backsql_add_attr(
                                i, new_keyval );
                Debug( LDAP_DEBUG_TRACE, "   backsql_add_attr(\"%s\"): "
                        "executing \"%s\" %s\n", 
-                       op->oq_add.rs_e->e_name.bv_val,
+                       op->ora_e->e_name.bv_val,
                        at_rec->bam_add_proc, logbuf );
 #endif
                rc = SQLExecute( sth );
@@ -912,12 +918,12 @@ backsql_add_attr(
                        Debug( LDAP_DEBUG_TRACE,
                                "   backsql_add_attr(\"%s\"): "
                                "add_proc execution failed (rc=%d, prc=%d)\n", 
-                               op->oq_add.rs_e->e_name.bv_val, rc, prc );
+                               op->ora_e->e_name.bv_val, rc, prc );
                        if ( prc != LDAP_SUCCESS ) {
                                /* SQL procedure executed fine
                                 * but returned an error */
                                rs->sr_err = BACKSQL_SANITIZE_ERROR( prc );
-                               rs->sr_text = op->oq_add.rs_e->e_name.bv_val;
+                               rs->sr_text = op->ora_e->e_name.bv_val;
                                SQLFreeStmt( sth, SQL_DROP );
                                return rs->sr_err;
 
@@ -926,7 +932,7 @@ backsql_add_attr(
                                                sth, rc );
                                if ( BACKSQL_FAIL_IF_NO_MAPPING( bi ) ) {
                                        rs->sr_err = LDAP_OTHER;
-                                       rs->sr_text = op->oq_add.rs_e->e_name.bv_val;
+                                       rs->sr_text = op->ora_e->e_name.bv_val;
                                        SQLFreeStmt( sth, SQL_DROP );
                                        return rs->sr_err;
                                }
@@ -947,13 +953,15 @@ backsql_add( Operation *op, SlapReply *rs )
        unsigned long           new_keyval = 0;
        RETCODE                 rc;
        backsql_oc_map_rec      *oc = NULL;
-       backsql_entryID         parent_id = BACKSQL_ENTRYID_INIT;
-       Entry                   p;
+       backsql_srch_info       bsi = { 0 };
+       Entry                   p = { 0 }, *e = NULL;
        Attribute               *at,
                                *at_objectClass = NULL;
+       struct berval           scname = BER_BVNULL;
        struct berval           pdn;
        struct berval           realdn = BER_BVNULL;
        int                     colnum;
+       slap_mask_t             mask;
 
 #ifdef BACKSQL_SYNCPROV
        /*
@@ -975,43 +983,77 @@ backsql_add( Operation *op, SlapReply *rs )
 #endif /* BACKSQL_SYNCPROV */
 
        Debug( LDAP_DEBUG_TRACE, "==>backsql_add(\"%s\")\n",
-                       op->oq_add.rs_e->e_name.bv_val, 0, 0 );
+                       op->ora_e->e_name.bv_val, 0, 0 );
 
        /* check schema */
        if ( global_schemacheck ) {
                char            textbuf[ SLAP_TEXT_BUFLEN ] = { '\0' };
 
-               rs->sr_err = entry_schema_check( op->o_bd, op->oq_add.rs_e,
+               rs->sr_err = entry_schema_check( op->o_bd, op->ora_e,
                                NULL,
                                &rs->sr_text, textbuf, sizeof( textbuf ) );
                if ( rs->sr_err != LDAP_SUCCESS ) {
                        Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                                "entry failed schema check -- aborting\n",
-                               op->oq_add.rs_e->e_name.bv_val, 0, 0 );
+                               op->ora_e->e_name.bv_val, 0, 0 );
+                       e = NULL;
                        goto done;
                }
        }
 
-       /* search structural objectClass */
-       for ( at = op->oq_add.rs_e->e_attrs; at != NULL; at = at->a_next ) {
+       /* search structuralObjectClass */
+       for ( at = op->ora_e->e_attrs; at != NULL; at = at->a_next ) {
                if ( at->a_desc == slap_schema.si_ad_structuralObjectClass ) {
                        break;
                }
        }
 
        /* there must exist */
-       assert( at != NULL );
+       if ( at == NULL ) {
+               char            buf[ SLAP_TEXT_BUFLEN ];
+               const char      *text;
+
+               /* search structuralObjectClass */
+               for ( at = op->ora_e->e_attrs; at != NULL; at = at->a_next ) {
+                       if ( at->a_desc == slap_schema.si_ad_objectClass ) {
+                               break;
+                       }
+               }
+
+               if ( at == NULL ) {
+                       Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
+                               "no objectClass\n",
+                               op->ora_e->e_name.bv_val, 0, 0 );
+                       rs->sr_err = LDAP_OBJECT_CLASS_VIOLATION;
+                       e = NULL;
+                       goto done;
+               }
+
+               rs->sr_err = structural_class( at->a_vals, &scname, NULL,
+                               &text, buf, sizeof( buf ) );
+               if ( rs->sr_err != LDAP_SUCCESS ) {
+                       Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
+                               "%s (%d)\n",
+                               op->ora_e->e_name.bv_val, text, rs->sr_err );
+                       e = NULL;
+                       goto done;
+               }
+
+       } else {
+               scname = at->a_vals[0];
+       }
 
        /* I guess we should play with sub/supertypes to find a suitable oc */
-       oc = backsql_name2oc( bi, &at->a_vals[0] );
+       oc = backsql_name2oc( bi, &scname );
 
        if ( oc == NULL ) {
                Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                        "cannot map structuralObjectClass \"%s\" -- aborting\n",
-                       op->oq_add.rs_e->e_name.bv_val,
-                       at->a_vals[0].bv_val, 0 );
+                       op->ora_e->e_name.bv_val,
+                       scname.bv_val, 0 );
                rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
                rs->sr_text = "operation not permitted within namingContext";
+               e = NULL;
                goto done;
        }
 
@@ -1019,10 +1061,11 @@ backsql_add( Operation *op, SlapReply *rs )
                Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                        "create procedure is not defined "
                        "for structuralObjectClass \"%s\" - aborting\n",
-                       op->oq_add.rs_e->e_name.bv_val,
-                       at->a_vals[0].bv_val, 0 );
+                       op->ora_e->e_name.bv_val,
+                       scname.bv_val, 0 );
                rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
                rs->sr_text = "operation not permitted within namingContext";
+               e = NULL;
                goto done;
 
        } else if ( BACKSQL_CREATE_NEEDS_SELECT( bi )
@@ -1031,10 +1074,11 @@ backsql_add( Operation *op, SlapReply *rs )
                        "create procedure needs select procedure, "
                        "but none is defined for structuralObjectClass \"%s\" "
                        "- aborting\n",
-                       op->oq_add.rs_e->e_name.bv_val,
-                       at->a_vals[0].bv_val, 0 );
+                       op->ora_e->e_name.bv_val,
+                       scname.bv_val, 0 );
                rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
                rs->sr_text = "operation not permitted within namingContext";
+               e = NULL;
                goto done;
        }
 
@@ -1042,9 +1086,10 @@ backsql_add( Operation *op, SlapReply *rs )
        if ( rs->sr_err != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                        "could not get connection handle - exiting\n", 
-                       op->oq_add.rs_e->e_name.bv_val, 0, 0 );
+                       op->ora_e->e_name.bv_val, 0, 0 );
                rs->sr_text = ( rs->sr_err == LDAP_OTHER )
                        ?  "SQL-backend error" : NULL;
+               e = NULL;
                goto done;
        }
 
@@ -1054,105 +1099,81 @@ backsql_add( Operation *op, SlapReply *rs )
         * NOTE: backsql_api_dn2odbc() is called explicitly because
         * we need the mucked DN to pass it to the create procedure.
         */
-       realdn = op->oq_add.rs_e->e_name;
+       realdn = op->ora_e->e_name;
        if ( backsql_api_dn2odbc( op, rs, &realdn ) ) {
                Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                        "backsql_api_dn2odbc(\"%s\") failed\n", 
-                       op->oq_add.rs_e->e_name.bv_val, realdn.bv_val, 0 );
+                       op->ora_e->e_name.bv_val, realdn.bv_val, 0 );
                rs->sr_err = LDAP_OTHER;
                rs->sr_text = "SQL-backend error";
+               e = NULL;
                goto done;
        }
 
-       rs->sr_err = backsql_dn2id( op, rs, NULL, dbh, &realdn, 0 );
+       rs->sr_err = backsql_dn2id( op, rs, dbh, &realdn, NULL, 0, 0 );
        if ( rs->sr_err == LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                        "entry exists\n",
-                       op->oq_add.rs_e->e_name.bv_val, 0, 0 );
+                       op->ora_e->e_name.bv_val, 0, 0 );
                rs->sr_err = LDAP_ALREADY_EXISTS;
+               e = op->ora_e;
                goto done;
        }
 
        /*
         * Get the parent dn and see if the corresponding entry exists.
         */
-       if ( be_issuffix( op->o_bd, &op->oq_add.rs_e->e_nname ) ) {
+       if ( be_issuffix( op->o_bd, &op->ora_e->e_nname ) ) {
                pdn = slap_empty_bv;
 
        } else {
-               dnParent( &op->oq_add.rs_e->e_nname, &pdn );
+               dnParent( &op->ora_e->e_nname, &pdn );
        }
 
-       rs->sr_err = backsql_dn2id( op, rs, &parent_id, dbh, &pdn, 1 );
+       /*
+        * Get the parent
+        */
+       bsi.bsi_e = &p;
+       rs->sr_err = backsql_init_search( &bsi, &pdn,
+                       LDAP_SCOPE_BASE, 
+                       SLAP_NO_LIMIT, SLAP_NO_LIMIT,
+                       (time_t)(-1), NULL, dbh, op, rs, slap_anlist_no_attrs,
+                       ( BACKSQL_ISF_MATCHED | BACKSQL_ISF_GET_ENTRY ) );
        if ( rs->sr_err != LDAP_SUCCESS ) {
-               Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
-                       "could not lookup parent entry for new record \"%s\"\n",
-                       op->oq_add.rs_e->e_name.bv_val, pdn.bv_val, 0 );
-
-               if ( rs->sr_err != LDAP_NO_SUCH_OBJECT ) {
-                       goto done;
-               }
-
-               /*
-                * no parent!
-                *  if not attempting to add entry at suffix or with parent ""
-                */
-               if ( ( ( !be_isroot( op ) && !be_shadow_update( op ) )
-                       || !BER_BVISEMPTY( &pdn ) ) && !is_entry_glue( op->oq_add.rs_e )
-                       && !BACKSQL_ALLOW_ORPHANS( bi ) )
-               {
-                       Debug( LDAP_DEBUG_TRACE, "   backsql_add: %s denied\n",
-                               BER_BVISEMPTY( &pdn ) ? "suffix" : "entry at root",
-                               0, 0 );
-                       /*
-                        * Look for matched
-                        */
-                       while ( 1 ) {
-                               struct berval   dn;
-                               char            *matched = NULL;
-       
-                               dn = pdn;
-                               dnParent( &dn, &pdn );
-       
-                               /*
-                                * Empty DN ("") defaults to LDAP_SUCCESS
-                                */
-                               rs->sr_err = backsql_dn2id( op, rs, NULL, dbh, &pdn, 1 );
-                               switch ( rs->sr_err ) {
-                               case LDAP_NO_SUCH_OBJECT:
-                                       if ( !BER_BVISEMPTY( &pdn ) ) {
-                                               break;
-                                       }
-                                       /* fail over to next case */
-                                       
-                               case LDAP_SUCCESS:
-                                       matched = pdn.bv_val;
-                                       /* fail over to next case */
-       
-                               default:
-                                       rs->sr_err = LDAP_NO_SUCH_OBJECT;
-                                       rs->sr_matched = matched;
-                                       goto done;
-                               } 
-                       }
-               } else {
-
-#ifdef BACKSQL_ARBITRARY_KEY
-                       ber_str2bv( "SUFFIX", 0, 1, &parent_id.eid_id );
-#else /* ! BACKSQL_ARBITRARY_KEY */
-                       parent_id.eid_id = 0;
-#endif /* ! BACKSQL_ARBITRARY_KEY */
-                       rs->sr_err = LDAP_SUCCESS;
-               }
+               Debug( LDAP_DEBUG_TRACE, "backsql_add(): "
+                       "could not retrieve addDN parent "
+                       "\"%s\" ID - %s matched=\"%s\"\n", 
+                       pdn.bv_val,
+                       rs->sr_err == LDAP_REFERRAL ? "referral" : "no such entry",
+                       rs->sr_matched ? rs->sr_matched : "(null)" );
+               e = &p;
+               goto done;
        }
 
        /* check "children" pseudo-attribute access to parent */
-       p.e_attrs = NULL;
-       p.e_name = pdn;
-       dnParent( &op->oq_add.rs_e->e_nname, &p.e_nname );
        if ( !access_allowed( op, &p, slap_schema.si_ad_children,
-                               NULL, ACL_WRITE, NULL ) ) {
+                               NULL, ACL_WRITE, NULL ) )
+       {
                rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
+               e = &p;
+               goto done;
+       }
+
+       if ( get_assert( op ) &&
+               ( test_filter( op, op->oq_add.rs_e, get_assertion( op ) )
+                       != LDAP_COMPARE_TRUE ) )
+       {
+               rs->sr_err = LDAP_ASSERTION_FAILED;
+               e = op->ora_e;
+               goto done;
+       }
+
+       if ( !access_allowed_mask( op, op->ora_e,
+                               slap_schema.si_ad_entry,
+                               NULL, ACL_WRITE, NULL, &mask ) )
+       {
+               rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
+               e = op->ora_e;
                goto done;
        }
 
@@ -1162,11 +1183,11 @@ backsql_add( Operation *op, SlapReply *rs )
         * the id of the added row; otherwise the procedure
         * is expected to return the id as the first column of a select
         */
-
-       rc = SQLAllocStmt( dbh, &sth );
+       rc = backsql_Prepare( dbh, &sth, oc->bom_create_proc, 0 );
        if ( rc != SQL_SUCCESS ) {
                rs->sr_err = LDAP_OTHER;
                rs->sr_text = "SQL-backend error";
+               e = NULL;
                goto done;
        }
 
@@ -1174,23 +1195,25 @@ backsql_add( Operation *op, SlapReply *rs )
        if ( BACKSQL_IS_ADD( oc->bom_expect_return ) ) {
                rc = backsql_BindParamInt( sth, 1, SQL_PARAM_OUTPUT, &new_keyval );
                if ( rc != SQL_SUCCESS ) {
-                       Debug( LDAP_DEBUG_TRACE,
-                               "   backsql_add_attr(): "
-                               "error binding keyval parameter for objectClass %s\n",
-                               oc->bom_oc->soc_cname.bv_val, 0, 0 );
+                       Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
+                               "error binding keyval parameter "
+                               "for objectClass %s\n",
+                               op->ora_e->e_name.bv_val,
+                               oc->bom_oc->soc_cname.bv_val, 0 );
                        backsql_PrintErrors( bi->sql_db_env, dbh, 
                                sth, rc );
                        SQLFreeStmt( sth, SQL_DROP );
 
                        rs->sr_text = "SQL-backend error";
                        rs->sr_err = LDAP_OTHER;
+                       e = NULL;
                        goto done;
                }
                colnum++;
        }
 
        if ( oc->bom_create_hint ) {
-               at = attr_find( op->oq_add.rs_e->e_attrs, oc->bom_create_hint );
+               at = attr_find( op->ora_e->e_attrs, oc->bom_create_hint );
                if ( at && at->a_vals ) {
                        backsql_BindParamStr( sth, colnum, SQL_PARAM_INPUT,
                                        at->a_vals[0].bv_val,
@@ -1207,25 +1230,26 @@ backsql_add( Operation *op, SlapReply *rs )
                                        oc->bom_create_hint->ad_cname.bv_val,
                                        0, 0 );
                }
+               colnum++;
        }
 
        Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): executing \"%s\"\n",
-               op->oq_add.rs_e->e_name.bv_val, oc->bom_create_proc, 0 );
-       rc = SQLExecDirect( sth, oc->bom_create_proc, SQL_NTS );
+               op->ora_e->e_name.bv_val, oc->bom_create_proc, 0 );
+       rc = SQLExecute( sth );
        if ( rc != SQL_SUCCESS ) {
                Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                        "create_proc execution failed\n",
-                       op->oq_add.rs_e->e_name.bv_val, 0, 0 );
+                       op->ora_e->e_name.bv_val, 0, 0 );
                backsql_PrintErrors( bi->sql_db_env, dbh, sth, rc);
                SQLFreeStmt( sth, SQL_DROP );
                rs->sr_err = LDAP_OTHER;
                rs->sr_text = "SQL-backend error";
+               e = NULL;
                goto done;
        }
 
-       if ( op->o_noop ) {
-               SQLTransact( SQL_NULL_HENV, dbh, SQL_ROLLBACK );
-       }
+       /* FIXME: after SQLExecute(), the row is already inserted
+        * (at least with PostgreSQL and unixODBC); needs investigation */
 
        if ( !BACKSQL_IS_ADD( oc->bom_expect_return ) ) {
                SWORD           ncols;
@@ -1233,17 +1257,20 @@ backsql_add( Operation *op, SlapReply *rs )
 
                if ( BACKSQL_CREATE_NEEDS_SELECT( bi ) ) {
                        SQLFreeStmt( sth, SQL_DROP );
-                       rc = SQLAllocStmt( dbh, &sth );
+
+                       rc = backsql_Prepare( dbh, &sth, oc->bom_create_keyval, 0 );
                        if ( rc != SQL_SUCCESS ) {
                                rs->sr_err = LDAP_OTHER;
                                rs->sr_text = "SQL-backend error";
+                               e = NULL;
                                goto done;
                        }
 
-                       rc = SQLExecDirect( sth, oc->bom_create_keyval, SQL_NTS );
+                       rc = SQLExecute( sth );
                        if ( rc != SQL_SUCCESS ) {
                                rs->sr_err = LDAP_OTHER;
                                rs->sr_text = "SQL-backend error";
+                               e = NULL;
                                goto done;
                        }
                }
@@ -1256,21 +1283,23 @@ backsql_add( Operation *op, SlapReply *rs )
                if ( rc != SQL_SUCCESS ) {
                        Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                                "create_proc result evaluation failed\n",
-                               op->oq_add.rs_e->e_name.bv_val, 0, 0 );
+                               op->ora_e->e_name.bv_val, 0, 0 );
                        backsql_PrintErrors( bi->sql_db_env, dbh, sth, rc);
                        SQLFreeStmt( sth, SQL_DROP );
                        rs->sr_err = LDAP_OTHER;
                        rs->sr_text = "SQL-backend error";
+                       e = NULL;
                        goto done;
 
                } else if ( ncols != 1 ) {
                        Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                                "create_proc result is bogus (ncols=%d)\n",
-                               op->oq_add.rs_e->e_name.bv_val, ncols, 0 );
+                               op->ora_e->e_name.bv_val, ncols, 0 );
                        backsql_PrintErrors( bi->sql_db_env, dbh, sth, rc);
                        SQLFreeStmt( sth, SQL_DROP );
                        rs->sr_err = LDAP_OTHER;
                        rs->sr_text = "SQL-backend error";
+                       e = NULL;
                        goto done;
                }
 
@@ -1302,11 +1331,12 @@ backsql_add( Operation *op, SlapReply *rs )
                if ( value_len <= 0 ) {
                        Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                                "create_proc result is empty?\n",
-                               op->oq_add.rs_e->e_name.bv_val, 0, 0 );
+                               op->ora_e->e_name.bv_val, 0, 0 );
                        backsql_PrintErrors( bi->sql_db_env, dbh, sth, rc);
                        SQLFreeStmt( sth, SQL_DROP );
                        rs->sr_err = LDAP_OTHER;
                        rs->sr_text = "SQL-backend error";
+                       e = NULL;
                        goto done;
                }
        }
@@ -1315,118 +1345,99 @@ backsql_add( Operation *op, SlapReply *rs )
 
        Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                "create_proc returned keyval=%ld\n",
-               op->oq_add.rs_e->e_name.bv_val, new_keyval, 0 );
-
-       for ( at = op->oq_add.rs_e->e_attrs; at != NULL; at = at->a_next ) {
-               Debug( LDAP_DEBUG_TRACE, "   backsql_add(): "
-                       "adding attribute \"%s\"\n", 
-                       at->a_desc->ad_cname.bv_val, 0, 0 );
-
-               /*
-                * Skip:
-                * - the first occurrence of objectClass, which is used
-                *   to determine how to build the SQL entry (FIXME ?!?)
-                * - operational attributes
-                * - empty attributes (FIXME ?!?)
-                */
-               if ( backsql_attr_skip( at->a_desc, at->a_vals ) ) {
-                       continue;
-               }
-
-               if ( at->a_desc == slap_schema.si_ad_objectClass ) {
-                       at_objectClass = at;
-                       continue;
-               }
-
-               rs->sr_err = backsql_add_attr( op, rs, dbh, oc, at, new_keyval );
-               if ( rs->sr_err != LDAP_SUCCESS ) {
-                       goto done;
-               }
-       }
+               op->ora_e->e_name.bv_val, new_keyval, 0 );
 
-       rc = backsql_Prepare( dbh, &sth, bi->sql_insentry_query, 0 );
+       rc = backsql_Prepare( dbh, &sth, bi->sql_insentry_stmt, 0 );
        if ( rc != SQL_SUCCESS ) {
                rs->sr_err = LDAP_OTHER;
                rs->sr_text = "SQL-backend error";
+               e = NULL;
                goto done;
        }
        
        rc = backsql_BindParamBerVal( sth, 1, SQL_PARAM_INPUT, &realdn );
        if ( rc != SQL_SUCCESS ) {
-               Debug( LDAP_DEBUG_TRACE,
-                       "   backsql_add_attr(): "
+               Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                        "error binding DN parameter for objectClass %s\n",
-                       oc->bom_oc->soc_cname.bv_val, 0, 0 );
+                       op->ora_e->e_name.bv_val,
+                       oc->bom_oc->soc_cname.bv_val, 0 );
                backsql_PrintErrors( bi->sql_db_env, dbh, 
                        sth, rc );
                SQLFreeStmt( sth, SQL_DROP );
 
                rs->sr_text = "SQL-backend error";
                rs->sr_err = LDAP_OTHER;
+               e = NULL;
                goto done;
        }
 
        rc = backsql_BindParamInt( sth, 2, SQL_PARAM_INPUT, &oc->bom_id );
        if ( rc != SQL_SUCCESS ) {
-               Debug( LDAP_DEBUG_TRACE,
-                       "   backsql_add_attr(): "
-                       "error binding objectClass ID parameter for objectClass %s\n",
-                       oc->bom_oc->soc_cname.bv_val, 0, 0 );
+               Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
+                       "error binding objectClass ID parameter "
+                       "for objectClass %s\n",
+                       op->ora_e->e_name.bv_val,
+                       oc->bom_oc->soc_cname.bv_val, 0 );
                backsql_PrintErrors( bi->sql_db_env, dbh, 
                        sth, rc );
                SQLFreeStmt( sth, SQL_DROP );
 
                rs->sr_text = "SQL-backend error";
                rs->sr_err = LDAP_OTHER;
+               e = NULL;
                goto done;
        }
 
-       rc = backsql_BindParamID( sth, 3, SQL_PARAM_INPUT, &parent_id.eid_id );
+       rc = backsql_BindParamID( sth, 3, SQL_PARAM_INPUT, &bsi.bsi_base_id.eid_id );
        if ( rc != SQL_SUCCESS ) {
-               Debug( LDAP_DEBUG_TRACE,
-                       "   backsql_add_attr(): "
-                       "error binding parent ID parameter for objectClass %s\n",
-                       oc->bom_oc->soc_cname.bv_val, 0, 0 );
+               Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
+                       "error binding parent ID parameter "
+                       "for objectClass %s\n",
+                       op->ora_e->e_name.bv_val,
+                       oc->bom_oc->soc_cname.bv_val, 0 );
                backsql_PrintErrors( bi->sql_db_env, dbh, 
                        sth, rc );
                SQLFreeStmt( sth, SQL_DROP );
 
                rs->sr_text = "SQL-backend error";
                rs->sr_err = LDAP_OTHER;
+               e = NULL;
                goto done;
        }
 
        rc = backsql_BindParamInt( sth, 4, SQL_PARAM_INPUT, &new_keyval );
        if ( rc != SQL_SUCCESS ) {
-               Debug( LDAP_DEBUG_TRACE,
-                       "   backsql_add_attr(): "
-                       "error binding entry ID parameter for objectClass %s\n",
-                       oc->bom_oc->soc_cname.bv_val, 0, 0 );
+               Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
+                       "error binding entry ID parameter "
+                       "for objectClass %s\n",
+                       op->ora_e->e_name.bv_val,
+                       oc->bom_oc->soc_cname.bv_val, 0 );
                backsql_PrintErrors( bi->sql_db_env, dbh, 
                        sth, rc );
                SQLFreeStmt( sth, SQL_DROP );
 
                rs->sr_text = "SQL-backend error";
                rs->sr_err = LDAP_OTHER;
+               e = NULL;
                goto done;
        }
 
        Debug( LDAP_DEBUG_TRACE, "   backsql_add(): executing \"%s\" for dn \"%s\"\n",
-                       bi->sql_insentry_query, op->oq_add.rs_e->e_name.bv_val, 0 );
+                       bi->sql_insentry_stmt, op->ora_e->e_name.bv_val, 0 );
 #ifdef BACKSQL_ARBITRARY_KEY
        Debug( LDAP_DEBUG_TRACE, "                  for oc_map_id=%ld, "
-                       "parent_id=%s, keyval=%ld\n",
-                       oc->bom_id, parent_id.eid_id.bv_val, new_keyval );
+                       "p_id=%s, keyval=%ld\n",
+                       oc->bom_id, bsi.bsi_base_id.eid_id.bv_val, new_keyval );
 #else /* ! BACKSQL_ARBITRARY_KEY */
        Debug( LDAP_DEBUG_TRACE, "                  for oc_map_id=%ld, "
-                       "parent_id=%ld, keyval=%ld\n",
-                       oc->bom_id, parent_id.eid_id, new_keyval );
+                       "p_id=%ld, keyval=%ld\n",
+                       oc->bom_id, bsi.bsi_base_id.eid_id, new_keyval );
 #endif /* ! BACKSQL_ARBITRARY_KEY */
        rc = SQLExecute( sth );
        if ( rc != SQL_SUCCESS ) {
                Debug( LDAP_DEBUG_TRACE, "   backsql_add(\"%s\"): "
                        "could not insert ldap_entries record\n",
-                       op->oq_add.rs_e->e_name.bv_val, 0, 0 );
+                       op->ora_e->e_name.bv_val, 0, 0 );
                backsql_PrintErrors( bi->sql_db_env, dbh, sth, rc );
                
                /*
@@ -1435,28 +1446,61 @@ backsql_add( Operation *op, SlapReply *rs )
                SQLFreeStmt( sth, SQL_DROP );
                rs->sr_err = LDAP_OTHER;
                rs->sr_text = "SQL-backend error";
+               e = NULL;
                goto done;
        }
 
-       /* FIXME: need ldap_entries.id of newly added entry */
-       if ( at_objectClass ) {
-               rs->sr_err = backsql_add_attr( op, rs, dbh, oc, at_objectClass, new_keyval );
+       SQLFreeStmt( sth, SQL_DROP );
+
+       for ( at = op->ora_e->e_attrs; at != NULL; at = at->a_next ) {
+               Debug( LDAP_DEBUG_TRACE, "   backsql_add(): "
+                       "adding attribute \"%s\"\n", 
+                       at->a_desc->ad_cname.bv_val, 0, 0 );
+
+               /*
+                * Skip:
+                * - the first occurrence of objectClass, which is used
+                *   to determine how to build the SQL entry (FIXME ?!?)
+                * - operational attributes
+                * - empty attributes (FIXME ?!?)
+                */
+               if ( backsql_attr_skip( at->a_desc, at->a_vals ) ) {
+                       continue;
+               }
+
+               if ( at->a_desc == slap_schema.si_ad_objectClass ) {
+                       at_objectClass = at;
+                       continue;
+               }
+
+               rs->sr_err = backsql_add_attr( op, rs, dbh, oc, at, new_keyval );
                if ( rs->sr_err != LDAP_SUCCESS ) {
+                       e = op->ora_e;
                        goto done;
                }
        }
 
-       SQLFreeStmt( sth, SQL_DROP );
+       if ( at_objectClass ) {
+               rs->sr_err = backsql_add_attr( op, rs, dbh, oc,
+                               at_objectClass, new_keyval );
+               if ( rs->sr_err != LDAP_SUCCESS ) {
+                       e = op->ora_e;
+                       goto done;
+               }
+       }
 
 done:;
        /*
         * Commit only if all operations succeed
         */
-       if ( rs->sr_err == LDAP_SUCCESS && !op->o_noop ) {
-               SQLTransact( SQL_NULL_HENV, dbh, SQL_COMMIT );
+       if ( sth != SQL_NULL_HSTMT ) {
+               SQLUSMALLINT    CompletionType = SQL_ROLLBACK;
 
-       } else {
-               SQLTransact( SQL_NULL_HENV, dbh, SQL_ROLLBACK );
+               if ( rs->sr_err == LDAP_SUCCESS && !op->o_noop ) {
+                       CompletionType = SQL_COMMIT;
+               }
+
+               SQLTransact( SQL_NULL_HENV, dbh, CompletionType );
        }
 
        /*
@@ -1470,22 +1514,61 @@ done:;
         * in deleting that row.
         */
 
+#ifdef SLAP_ACL_HONOR_DISCLOSE
+       if ( e != NULL ) {
+               int     disclose = 1;
+
+               if ( e == op->ora_e && !ACL_GRANT( mask, ACL_DISCLOSE ) ) {
+                       /* mask already collected */
+                       disclose = 0;
+
+               } else if ( e == &p && !access_allowed( op, &p,
+                                       slap_schema.si_ad_entry, NULL,
+                                       ACL_DISCLOSE, NULL ) )
+               {
+                       disclose = 0;
+               }
+
+               if ( disclose == 0 ) {
+                       rs->sr_err = LDAP_NO_SUCH_OBJECT;
+                       rs->sr_text = NULL;
+                       rs->sr_matched = NULL;
+                       if ( rs->sr_ref ) {
+                               ber_bvarray_free( rs->sr_ref );
+                               rs->sr_ref = NULL;
+                       }
+               }
+       }
+#endif /* SLAP_ACL_HONOR_DISCLOSE */
+
        send_ldap_result( op, rs );
 
        if ( !BER_BVISNULL( &realdn )
-                       && realdn.bv_val != op->oq_add.rs_e->e_name.bv_val )
+                       && realdn.bv_val != op->ora_e->e_name.bv_val )
        {
                ch_free( realdn.bv_val );
        }
-       if ( !BER_BVISNULL( &parent_id.eid_ndn ) ) {
-               (void)backsql_free_entryID( &parent_id, 0 );
+
+       if ( !BER_BVISNULL( &bsi.bsi_base_id.eid_ndn ) ) {
+               (void)backsql_free_entryID( op, &bsi.bsi_base_id, 0 );
+       }
+
+       if ( !BER_BVISNULL( &p.e_nname ) ) {
+               entry_clean( &p );
        }
 
        Debug( LDAP_DEBUG_TRACE, "<==backsql_add(\"%s\"): %d \"%s\"\n",
-                       op->oq_add.rs_e->e_name.bv_val,
+                       op->ora_e->e_name.bv_val,
                        rs->sr_err,
                        rs->sr_text ? rs->sr_text : "" );
 
-       return ( ( rs->sr_err == LDAP_SUCCESS ) ? op->o_noop : 1 );
+       rs->sr_text = NULL;
+       rs->sr_matched = NULL;
+       if ( rs->sr_ref ) {
+               ber_bvarray_free( rs->sr_ref );
+               rs->sr_ref = NULL;
+       }
+
+       return rs->sr_err;
 }