Consistently don't require "entry" access (except on search)

diff --git a/servers/slapd/back-ldbm/bind.c b/servers/slapd/back-ldbm/bind.c
index e31a267f6972d0ef0492deb5737444883ea45dc6..449fac2ee11bd400a25cd357a9a1cceb4cabd10c 100644 (file)
--- a/servers/slapd/back-ldbm/bind.c
+++ b/servers/slapd/back-ldbm/bind.c
@@ -41,7 +41,6 @@ ldbm_back_bind(
 #endif
 
        AttributeDescription *password = slap_schema.si_ad_userPassword;
-       AttributeDescription *entry = slap_schema.si_ad_entry;
 
        Debug(LDAP_DEBUG_ARGS, "==> ldbm_back_bind: dn: %s\n", dn, 0, 0);
 
@@ -101,15 +100,6 @@ ldbm_back_bind(
 
        /* check for deleted */
 
-       if ( ! access_allowed( be, conn, op, e,
-               entry, NULL, ACL_AUTH ) )
-       {
-               send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
-                       NULL, NULL, NULL, NULL );
-               rc = 1;
-               goto return_results;
-       }
-
        if ( is_entry_alias( e ) ) {
                /* entry is an alias, don't allow bind */
                Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0,

diff --git a/servers/slapd/back-ldbm/delete.c b/servers/slapd/back-ldbm/delete.c
index c216f6b90136657ac87fbd3af4a2dfc43e2e83e8..dd0f7fc971f0136ee0e4fd40d1fad6d663f35b69 100644 (file)
--- a/servers/slapd/back-ldbm/delete.c
+++ b/servers/slapd/back-ldbm/delete.c
@@ -65,19 +65,6 @@ ldbm_back_delete(
                return( -1 );
        }
 
-#ifdef SLAPD_CHILD_MODIFICATION_WITH_ENTRY_ACL
-       if ( ! access_allowed( be, conn, op, e,
-               "entry", NULL, ACL_WRITE ) )
-       {
-               Debug(LDAP_DEBUG_ARGS,
-                       "<=- ldbm_back_delete: insufficient access %s\n",
-                       dn, 0, 0);
-               send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
-                       NULL, NULL, NULL, NULL );
-               goto return_results;
-       }
-#endif
-
     if ( !manageDSAit && is_entry_referral( e ) ) {
                /* parent is a referral, don't allow add */
                /* parent is an alias, don't allow add */

diff --git a/servers/slapd/back-ldbm/modrdn.c b/servers/slapd/back-ldbm/modrdn.c
index 3f1438fbf97df3bfd7040a15263258f3bfe6d95f..7367f2ad8bfb938b64497c5b7bd02ce3ab4e082e 100644 (file)
--- a/servers/slapd/back-ldbm/modrdn.c
+++ b/servers/slapd/back-ldbm/modrdn.c
@@ -102,18 +102,6 @@ ldbm_back_modrdn(
                return( -1 );
        }
 
-#ifdef SLAPD_CHILD_MODIFICATION_WITH_ENTRY_ACL
-       if ( ! access_allowed( be, conn, op, e,
-               "entry", NULL, ACL_WRITE ) )
-       {
-               Debug( LDAP_DEBUG_TRACE, "no access to entry\n", 0,
-                       0, 0 );
-               send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
-                       NULL, NULL, NULL, NULL );
-               goto return_results;
-       }
-#endif
-
        if (!manageDSAit && is_entry_referral( e ) ) {
                /* parent is a referral, don't allow add */
                /* parent is an alias, don't allow add */

diff --git a/servers/slapd/back-ldbm/passwd.c b/servers/slapd/back-ldbm/passwd.c
index 8f2c968db91eb72c617f00c8116a8b5374bd9868..b5156b0de3fcba9850cec27f64b61a9e37e2734f 100644 (file)
--- a/servers/slapd/back-ldbm/passwd.c
+++ b/servers/slapd/back-ldbm/passwd.c
@@ -40,8 +40,6 @@ ldbm_back_exop_passwd(
 
        char *dn;
 
-       AttributeDescription *entry = slap_schema.si_ad_entry;
-
        assert( reqoid != NULL );
        assert( strcmp( LDAP_EXOP_X_MODIFY_PASSWD, reqoid ) == 0 );
 
@@ -94,12 +92,6 @@ ldbm_back_exop_passwd(
                goto done;
        }
 
-       if( ! access_allowed( be, conn, op, e, entry, NULL, ACL_WRITE ) ) {
-               *text = "access to authorization entry denied";
-               rc = LDAP_INSUFFICIENT_ACCESS;
-               goto done;
-       }
-
        if( is_entry_alias( e ) ) {
                /* entry is an alias, don't allow operation */
                *text = "authorization entry is alias";