All "o=foo" add to suffix "" if bound as root.

diff --git a/servers/slapd/back-bdb2/add.c b/servers/slapd/back-bdb2/add.c
index f4e40709c6e67928648333225f7473009ab9af1e..1f51d43d52e6a80088cacab3800abbc2d7f5e3f6 100644 (file)
--- a/servers/slapd/back-bdb2/add.c
+++ b/servers/slapd/back-bdb2/add.c
@@ -52,9 +52,13 @@ bdb2i_back_add_internal(
         * add the entry.
         */
 
-       if ( (pdn = dn_parent( be, e->e_ndn )) != NULL ) {
+       pdn = dn_parent( be, e->e_ndn );
+
+       if( pdn != NULL && *pdn != '\0' && !be_issuffix(be, "") ) {
                char *matched = NULL;
 
+               assert( *pdn != '\0' );
+
                /* get parent with writer lock */
                if ( (p = bdb2i_dn2entry_w( be, pdn, &matched )) == NULL ) {
                        Debug( LDAP_DEBUG_TRACE, "parent does not exist\n", 0,
@@ -93,10 +97,17 @@ bdb2i_back_add_internal(
                }
 
        } else {
+               if(pdn != NULL) {
+                       assert( *pdn == '\0' );
+                       free(pdn);
+               }
+
                /* no parent, must be adding entry to root */
                if ( ! be_isroot( be, op->o_ndn ) ) {
-                       Debug( LDAP_DEBUG_TRACE, "no parent & not root\n", 0,
-                           0, 0 );
+                       Debug( LDAP_DEBUG_TRACE, "%s add denied\n",
+                               pdn == NULL ? "suffix" : "entry at root",
+                               0, 0 );
+
                        send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
                            "", "" );