X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fschema_check.c;h=8f33e1516f2180b5488d7ffe59dff2235718bcd2;hb=b0b3eff457f0e431c4fd094d3d9cfeb6383df91d;hp=2be55f9fd5190afa073d69a7bbd475fda81073c9;hpb=ac1332cdb868b6a30f545796aca8e0bbf13fe939;p=openldap

diff --git a/servers/slapd/schema_check.c b/servers/slapd/schema_check.c
index 2be55f9fd5..8f33e1516f 100644
--- a/servers/slapd/schema_check.c
+++ b/servers/slapd/schema_check.c
@@ -1,8 +1,17 @@
 /* schema_check.c - routines to enforce schema definitions */
 /* $OpenLDAP$ */
-/*
- * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
- * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2003 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
  */
 
 #include "portable.h"
@@ -21,6 +30,10 @@ static char * oc_check_required(
 	ObjectClass *oc,
 	struct berval *ocname );
 
+static int entry_naming_check(
+	Entry *e,
+	const char** text,
+	char *textbuf, size_t textlen );
 /*
  * entry_schema_check - check that entry e conforms to the schema required
  * by its object class(es).
@@ -38,6 +51,8 @@ entry_schema_check(
 {
 	Attribute	*a, *asc, *aoc;
 	ObjectClass *sc, *oc;
+	AttributeType *at;
+	ContentRule *cr;
 	int	rc, i;
 	struct berval nsc;
 	AttributeDescription *ad_structuralObjectClass
@@ -48,7 +63,13 @@ entry_schema_check(
 	int subentry = is_entry_subentry( e );
 	int collectiveSubentry = 0;
 
-	if( subentry) collectiveSubentry = is_entry_collectiveAttributes( e );
+	if ( SLAP_NO_SCHEMA_CHECK( be )) {
+		return LDAP_SUCCESS;
+	}
+
+	if( subentry ) {
+		collectiveSubentry = is_entry_collectiveAttributeSubentry( e );
+	}
 
 	*text = textbuf;
 
@@ -70,7 +91,7 @@ entry_schema_check(
 
 		if( !collectiveSubentry && is_at_collective( a->a_desc->ad_type ) ) {
 			snprintf( textbuf, textlen,
-				"'%s' can only appear in collectiveAttributes subentry",
+				"'%s' can only appear in collectiveAttributeSubentry",
 				type );
 			return LDAP_OBJECT_CLASS_VIOLATION;
 		}
@@ -84,9 +105,8 @@ entry_schema_check(
 				type );
 
 #ifdef NEW_LOGGING
-			LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
-				"entry_schema_check: dn=\"%s\" %s\n",
-				e->e_dn, textbuf ));
+			LDAP_LOG( OPERATION, INFO, 
+				"entry_schema_check: dn=\"%s\" %s\n", e->e_dn, textbuf, 0 );
 #else
 			Debug( LDAP_DEBUG_ANY,
 			    "Entry (%s), %s\n",
@@ -100,13 +120,13 @@ entry_schema_check(
 	/* it's a REALLY bad idea to disable schema checks */
 	if( !global_schemacheck ) return LDAP_SUCCESS;
 
-	/* find the object class attribute - could error out here */
+	/* find the structural object class attribute */
 	asc = attr_find( e->e_attrs, ad_structuralObjectClass );
 	if ( asc == NULL ) {
 #ifdef NEW_LOGGING
-		LDAP_LOG(( "schema", LDAP_LEVEL_INFO, "entry_schema_check: "
-			"No structuralObjectClass for entry (%s)\n",
-			e->e_dn ));
+		LDAP_LOG( OPERATION, INFO, 
+			"entry_schema_check: No structuralObjectClass for entry (%s)\n", 
+			e->e_dn, 0, 0 );
 #else
 		Debug( LDAP_DEBUG_ANY,
 			"No structuralObjectClass for entry (%s)\n",
@@ -114,7 +134,7 @@ entry_schema_check(
 #endif
 
 		*text = "no structuralObjectClass operational attribute";
-		return LDAP_OBJECT_CLASS_VIOLATION;
+		return LDAP_OTHER;
 	}
 
 	assert( asc->a_vals != NULL );
@@ -128,9 +148,8 @@ entry_schema_check(
 			asc->a_vals[0].bv_val );
 
 #ifdef NEW_LOGGING
-		LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
-			"entry_schema_check: dn (%s), %s\n",
-			e->e_dn, textbuf ));
+		LDAP_LOG( OPERATION, INFO, 
+			"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
 #else
 		Debug( LDAP_DEBUG_ANY,
 			"entry_check_schema(%s): %s\n",
@@ -146,9 +165,25 @@ entry_schema_check(
 			asc->a_vals[0].bv_val );
 
 #ifdef NEW_LOGGING
-		LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
-			"entry_schema_check: dn (%s), %s\n",
-			e->e_dn, textbuf ));
+		LDAP_LOG( OPERATION, INFO, 
+			"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
+#else
+		Debug( LDAP_DEBUG_ANY,
+			"entry_check_schema(%s): %s\n",
+			e->e_dn, textbuf, 0 );
+#endif
+
+		return LDAP_OTHER;
+	}
+
+	if( sc->soc_obsolete ) {
+		snprintf( textbuf, textlen, 
+			"structuralObjectClass '%s' is OBSOLETE",
+			asc->a_vals[0].bv_val );
+
+#ifdef NEW_LOGGING
+		LDAP_LOG( OPERATION, INFO, 
+			"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
 #else
 		Debug( LDAP_DEBUG_ANY,
 			"entry_check_schema(%s): %s\n",
@@ -162,9 +197,9 @@ entry_schema_check(
 	aoc = attr_find( e->e_attrs, ad_objectClass );
 	if ( aoc == NULL ) {
 #ifdef NEW_LOGGING
-		LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
-			"entry_schema_check: No objectClass for entry (%s).\n"
-			e->e_dn ));
+		LDAP_LOG( OPERATION, INFO, 
+			"entry_schema_check: No objectClass for entry (%s).\n", 
+			e->e_dn, 0, 0 );
 #else
 		Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n",
 		    e->e_dn, 0, 0 );
@@ -180,8 +215,6 @@ entry_schema_check(
 	rc = structural_class( aoc->a_vals, &nsc, &oc, text, textbuf, textlen );
 	if( rc != LDAP_SUCCESS ) {
 		return rc;
-	} else if ( nsc.bv_len == 0 ) {
-		return LDAP_OBJECT_CLASS_VIOLATION;
 	}
 
 	*text = textbuf;
@@ -192,11 +225,108 @@ entry_schema_check(
 			aoc->a_vals[0].bv_val );
 		return LDAP_OBJECT_CLASS_VIOLATION;
 
-	} else if ( sc != oc ) {
+	} else if ( sc != slap_schema.si_oc_glue && sc != oc ) {
 		snprintf( textbuf, textlen, 
-			"structuralObjectClass modification from '%s' to '%s' not allowed",
+			"structural object class modification "
+			"from '%s' to '%s' not allowed",
 			asc->a_vals[0].bv_val, nsc.bv_val );
 		return LDAP_NO_OBJECT_CLASS_MODS;
+	} else if ( sc == slap_schema.si_oc_glue ) {
+		sc = oc;
+	}
+
+	/* naming check */
+	if ( !is_entry_objectclass ( e, slap_schema.si_oc_glue, 0 ) ) {
+		rc = entry_naming_check( e, text, textbuf, textlen );
+		if( rc != LDAP_SUCCESS ) {
+			return rc;
+		}
+	} else {
+		/* Glue Entry */
+	}
+
+	/* find the content rule for the structural class */
+	cr = cr_find( sc->soc_oid );
+
+	/* the cr must be same as the structural class */
+	assert( !cr || !strcmp( cr->scr_oid, sc->soc_oid ) );
+
+	/* check that the entry has required attrs of the content rule */
+	if( cr ) {
+		if( cr->scr_obsolete ) {
+			snprintf( textbuf, textlen, 
+				"content rule '%s' is obsolete",
+				ldap_contentrule2name( &cr->scr_crule ));
+
+#ifdef NEW_LOGGING
+			LDAP_LOG( OPERATION, INFO, 
+				"entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 );
+#else
+			Debug( LDAP_DEBUG_ANY,
+				"Entry (%s): %s\n",
+				e->e_dn, textbuf, 0 );
+#endif
+
+			return LDAP_OBJECT_CLASS_VIOLATION;
+		}
+
+		if( cr->scr_required ) for( i=0; cr->scr_required[i]; i++ ) {
+			at = cr->scr_required[i];
+
+			for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
+				if( a->a_desc->ad_type == at ) {
+					break;
+				}
+			}
+
+			/* not there => schema violation */
+			if ( a == NULL ) {
+				snprintf( textbuf, textlen, 
+					"content rule '%s' requires attribute '%s'",
+					ldap_contentrule2name( &cr->scr_crule ),
+					at->sat_cname.bv_val );
+
+#ifdef NEW_LOGGING
+				LDAP_LOG( OPERATION, INFO, 
+					"entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 );
+#else
+				Debug( LDAP_DEBUG_ANY,
+					"Entry (%s): %s\n",
+					e->e_dn, textbuf, 0 );
+#endif
+
+				return LDAP_OBJECT_CLASS_VIOLATION;
+			}
+		}
+
+		if( cr->scr_precluded ) for( i=0; cr->scr_precluded[i]; i++ ) {
+			at = cr->scr_precluded[i];
+
+			for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
+				if( a->a_desc->ad_type == at ) {
+					break;
+				}
+			}
+
+			/* there => schema violation */
+			if ( a != NULL ) {
+				snprintf( textbuf, textlen, 
+					"content rule '%s' precluded attribute '%s'",
+					ldap_contentrule2name( &cr->scr_crule ),
+					at->sat_cname.bv_val );
+
+#ifdef NEW_LOGGING
+				LDAP_LOG( OPERATION, INFO, 
+					"entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 );
+#else
+				Debug( LDAP_DEBUG_ANY,
+					"Entry (%s): %s\n",
+					e->e_dn, textbuf, 0 );
+#endif
+
+				return LDAP_OBJECT_CLASS_VIOLATION;
+			}
+		}
 	}
 
 	/* check that the entry has required attrs for each oc */
@@ -207,9 +337,26 @@ entry_schema_check(
 				aoc->a_vals[i].bv_val );
 
 #ifdef NEW_LOGGING
-			LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
-				"entry_schema_check: dn (%s), %s\n",
-				e->e_dn, textbuf ));
+			LDAP_LOG( OPERATION, INFO, 
+				"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
+#else
+			Debug( LDAP_DEBUG_ANY,
+				"entry_check_schema(%s): %s\n",
+				e->e_dn, textbuf, 0 );
+#endif
+
+			return LDAP_OBJECT_CLASS_VIOLATION;
+		}
+
+		if ( oc->soc_obsolete ) {
+			/* disallow obsolete classes */
+			snprintf( textbuf, textlen, 
+				"objectClass '%s' is OBSOLETE",
+				aoc->a_vals[i].bv_val );
+
+#ifdef NEW_LOGGING
+			LDAP_LOG( OPERATION, INFO, 
+				"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
 #else
 			Debug( LDAP_DEBUG_ANY,
 				"entry_check_schema(%s): %s\n",
@@ -219,8 +366,8 @@ entry_schema_check(
 			return LDAP_OBJECT_CLASS_VIOLATION;
 		}
 
-		if ( oc->sco_check ) {
-			int rc = (oc->sco_check)( be, e, oc,
+		if ( oc->soc_check ) {
+			int rc = (oc->soc_check)( be, e, oc,
 				text, textbuf, textlen );
 			if( rc != LDAP_SUCCESS ) {
 				return rc;
@@ -243,9 +390,9 @@ entry_schema_check(
 								aoc->a_vals[i].bv_val );
 
 #ifdef NEW_LOGGING
-							LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
+							LDAP_LOG( OPERATION, INFO, 
 								"entry_schema_check: dn (%s), %s\n",
-								e->e_dn, textbuf ));
+								e->e_dn, textbuf, 0 );
 #else
 							Debug( LDAP_DEBUG_ANY,
 								"entry_check_schema(%s): %s\n",
@@ -264,10 +411,9 @@ entry_schema_check(
 						if ( xc->soc_kind == LDAP_SCHEMA_AUXILIARY &&
 							is_object_subclass( oc, xc ) )
 						{
-							break;;
+							xc = NULL;
+							break;
 						}
-
-						xc = NULL;
 					}
 				}
 
@@ -277,9 +423,9 @@ entry_schema_check(
 						aoc->a_vals[i].bv_val );
 
 #ifdef NEW_LOGGING
-					LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
-						"entry_schema_check: dn (%s), %s\n",
-						e->e_dn, textbuf ));
+					LDAP_LOG( OPERATION, INFO, 
+						"entry_schema_check: dn (%s), %s\n", 
+						e->e_dn, textbuf, 0 );
 #else
 					Debug( LDAP_DEBUG_ANY,
 						"entry_check_schema(%s): %s\n",
@@ -291,17 +437,58 @@ entry_schema_check(
 			}
 
 		} else if ( oc->soc_kind != LDAP_SCHEMA_STRUCTURAL || oc == sc ) {
-			char *s = oc_check_required( e, oc, &aoc->a_vals[i] );
+			char *s;
+
+			if( oc->soc_kind == LDAP_SCHEMA_AUXILIARY ) {
+				int k;
+
+				if( cr ) {
+					int j;
+
+					k = -1;
+					if( cr->scr_auxiliaries ) {
+						for( j = 0; cr->scr_auxiliaries[j]; j++ ) {
+							if( cr->scr_auxiliaries[j] == oc ) {
+								k = 0;
+								break;
+							}
+						}
+					}
+				} else if ( global_disallows & SLAP_DISALLOW_AUX_WO_CR ) {
+					k = -1;
+				} else {
+					k = 0;	
+				}
+
+				if( k == -1 ) {
+					snprintf( textbuf, textlen, 
+						"content rule '%s' does not allow class '%s'",
+						ldap_contentrule2name( &cr->scr_crule ),
+						oc->soc_cname.bv_val );
 
+#ifdef NEW_LOGGING
+					LDAP_LOG( OPERATION, INFO, 
+						"entry_schema_check: dn=\"%s\" %s",
+						e->e_dn, textbuf, 0 );
+#else
+					Debug( LDAP_DEBUG_ANY,
+						"Entry (%s): %s\n",
+						e->e_dn, textbuf, 0 );
+#endif
+
+					return LDAP_OBJECT_CLASS_VIOLATION;
+				}
+			}
+
+			s = oc_check_required( e, oc, &aoc->a_vals[i] );
 			if (s != NULL) {
 				snprintf( textbuf, textlen, 
 					"object class '%s' requires attribute '%s'",
 					aoc->a_vals[i].bv_val, s );
 
 #ifdef NEW_LOGGING
-				LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
-					"entry_schema_check: dn=\"%s\" %s",
-					e->e_dn, textbuf ));
+				LDAP_LOG( OPERATION, INFO, 
+					"entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 );
 #else
 				Debug( LDAP_DEBUG_ANY,
 					"Entry (%s): %s\n",
@@ -323,7 +510,33 @@ entry_schema_check(
 
 	/* check that each attr in the entry is allowed by some oc */
 	for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
-		int ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals, sc );
+		int ret;
+
+ 		ret = LDAP_OBJECT_CLASS_VIOLATION;
+
+		if( cr && cr->scr_required ) {
+			for( i=0; cr->scr_required[i]; i++ ) {
+				if( cr->scr_required[i] == a->a_desc->ad_type ) {
+					ret = LDAP_SUCCESS;
+					break;
+				}
+			}
+		}
+
+		if( ret != LDAP_SUCCESS && cr && cr->scr_allowed ) {
+			for( i=0; cr->scr_allowed[i]; i++ ) {
+				if( cr->scr_allowed[i] == a->a_desc->ad_type ) {
+					ret = LDAP_SUCCESS;
+					break;
+				}
+			}
+		}
+
+		if( ret != LDAP_SUCCESS ) 
+		{
+			ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals, sc );
+		}
+
 		if ( ret != LDAP_SUCCESS ) {
 			char *type = a->a_desc->ad_cname.bv_val;
 
@@ -332,9 +545,8 @@ entry_schema_check(
 				type );
 
 #ifdef NEW_LOGGING
-			LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
-				"entry_schema_check: dn=\"%s\" %s\n",
-				e->e_dn, textbuf ));
+			LDAP_LOG( OPERATION, INFO, 
+				"entry_schema_check: dn=\"%s\" %s\n", e->e_dn, textbuf, 0);
 #else
 			Debug( LDAP_DEBUG_ANY,
 			    "Entry (%s), %s\n",
@@ -359,9 +571,9 @@ oc_check_required(
 	Attribute	*a;
 
 #ifdef NEW_LOGGING
-	LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
-		"oc_check_required: dn (%s), objectClass \"%s\"\n",
-	e->e_dn, ocname->bv_val ));
+	LDAP_LOG( OPERATION, ENTRY, 
+		"oc_check_required: dn (%s), objectClass \"%s\"\n", 
+		e->e_dn, ocname->bv_val, 0 );
 #else
 	Debug( LDAP_DEBUG_TRACE,
 		"oc_check_required entry (%s), objectClass \"%s\"\n",
@@ -400,8 +612,8 @@ int oc_check_allowed(
 	int		i, j;
 
 #ifdef NEW_LOGGING
-	LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
-		"oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val ));
+	LDAP_LOG( OPERATION, ENTRY, 
+		"oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val, 0, 0 );
 #else
 	Debug( LDAP_DEBUG_TRACE,
 		"oc_check_allowed type \"%s\"\n",
@@ -494,7 +706,7 @@ int structural_class(
 
 		if( oc == NULL ) {
 			snprintf( textbuf, textlen,
-				"unrecongized objectClass '%s'",
+				"unrecognized objectClass '%s'",
 				ocs[i].bv_val );
 			*text = textbuf;
 			return LDAP_OBJECT_CLASS_VIOLATION;
@@ -515,8 +727,8 @@ int structural_class(
 
 					if( xc == NULL ) {
 						snprintf( textbuf, textlen,
-							"unrecongized objectClass '%s'",
-							ocs[i].bv_val );
+							"unrecognized objectClass '%s'",
+							ocs[j].bv_val );
 						*text = textbuf;
 						return LDAP_OBJECT_CLASS_VIOLATION;
 					}
@@ -548,15 +760,27 @@ int structural_class(
 		}
 	}
 
-	if( scp )
+	if( scp ) {
 		*scp = sc;
+	}
 
 	if( sc == NULL ) {
-		*text = "no structural object classes provided";
+		*text = "no structural object class provided";
+		return LDAP_OBJECT_CLASS_VIOLATION;
+	}
+
+	if( scn < 0 ) {
+		*text = "invalid structural object class";
 		return LDAP_OBJECT_CLASS_VIOLATION;
 	}
 
 	*scbv = ocs[scn];
+
+	if( scbv->bv_len == 0 ) {
+		*text = "invalid structural object class";
+		return LDAP_OBJECT_CLASS_VIOLATION;
+	}
+
 	return LDAP_SUCCESS;
 }
 
@@ -594,3 +818,133 @@ int mods_structural_class(
 	return structural_class( ocmod->sml_bvalues, sc, NULL,
 		text, textbuf, textlen );
 }
+
+
+static int
+entry_naming_check(
+	Entry *e,
+	const char** text,
+	char *textbuf, size_t textlen )
+{
+	/* naming check */
+	LDAPRDN		rdn = NULL;
+	const char	*p = NULL;
+	ber_len_t	cnt;
+	int		rc = LDAP_SUCCESS;
+
+	/*
+	 * Get attribute type(s) and attribute value(s) of our RDN
+	 */
+	if ( ldap_bv2rdn( &e->e_name, &rdn, (char **)&p,
+		LDAP_DN_FORMAT_LDAP ) )
+	{
+		*text = "unrecongized attribute type(s) in RDN";
+		return LDAP_INVALID_DN_SYNTAX;
+	}
+
+	/* Check that each AVA of the RDN is present in the entry */
+	/* FIXME: Should also check that each AVA lists a distinct type */
+	for ( cnt = 0; rdn[cnt]; cnt++ ) {
+		LDAPAVA *ava = rdn[cnt];
+		AttributeDescription *desc = NULL;
+		Attribute *attr;
+		const char *errtext;
+
+		if( ava->la_flags & LDAP_AVA_BINARY ) {
+			snprintf( textbuf, textlen, 
+				"value of naming attribute '%s' in unsupported BER form",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+		}
+
+		rc = slap_bv2ad( &ava->la_attr, &desc, &errtext );
+		if ( rc != LDAP_SUCCESS ) {
+			snprintf( textbuf, textlen, "%s (in RDN)", errtext );
+			break;
+		}
+
+		if( desc->ad_type->sat_usage ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' is operational",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+ 
+		if( desc->ad_type->sat_collective ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' is collective",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+
+		if( desc->ad_type->sat_obsolete ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' is collective",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+
+		if( !desc->ad_type->sat_equality ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' has no equality matching rule",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+
+		if( !desc->ad_type->sat_equality->smr_match ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' has unsupported equality matching rule",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+
+		/* find the naming attribute */
+		attr = attr_find( e->e_attrs, desc );
+		if ( attr == NULL ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' is not present in entry",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+
+		rc = value_find_ex( desc, SLAP_MR_VALUE_OF_ASSERTION_SYNTAX|
+			SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH,
+			attr->a_nvals, &ava->la_value, NULL );
+
+		if( rc != 0 ) {
+			switch( rc ) {
+			case LDAP_INAPPROPRIATE_MATCHING:
+				snprintf( textbuf, textlen, 
+					"inappropriate matching for naming attribute '%s'",
+					ava->la_attr.bv_val );
+				break;
+			case LDAP_INVALID_SYNTAX:
+				snprintf( textbuf, textlen, 
+					"value of naming attribute '%s' is invalid",
+					ava->la_attr.bv_val );
+				break;
+			case LDAP_NO_SUCH_ATTRIBUTE:
+				snprintf( textbuf, textlen, 
+					"value of naming attribute '%s' is not present in entry",
+					ava->la_attr.bv_val );
+				break;
+			default:
+				snprintf( textbuf, textlen, 
+					"naming attribute '%s' is inappropriate",
+					ava->la_attr.bv_val );
+			}
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+	}
+
+	ldap_rdnfree( rdn );
+	return rc;
+}
+