NextInterceptor next = null;
    private boolean filter( ServerLdapContext ctx, Name normName, SearchResult result ) throws NamingException    {       /*        * First call hasPermission() for entry level "Browse" and "ReturnDN" perm        * tests.  If we hasPermission() returns false we immediately short the        * process and return false.        *///        NextInterceptor next = chain.getNext( "authorizationService" );        NextInterceptor next = null;//chain.getNext( "authorizationService" );        Attributes entry = nexus.lookup( normName );        Name userDn = ctx.getPrincipal().getJndiName();        Set userGroups = groupCache.getGroups( userDn.toString() );        Collection tuples = new HashSet();        addPerscriptiveAciTuples( tuples, normName, entry );        addEntryAciTuples( tuples, entry );        addSubentryAciTuples( tuples, normName, entry );        if ( ! engine.hasPermission( next, userGroups, userDn, ctx.getPrincipal().getAuthenticationLevel(),                normName, null, null, SEARCH_ENTRY_PERMS, tuples, entry ) )        {            return false;        }        /*         * For each attribute type we check if access is allowed to the type.  If not         * the attribute is yanked out of the entry to be returned.  If permission is         * allowed we move on to check if the values are allowed.  Values that are         * not allowed are removed from the attribute.  If the attribute has no more         * values remaining then the entire attribute is removed.         */        NamingEnumeration attributeList = result.getAttributes().getAll();        while ( attributeList.hasMore() )        {            // if attribute type scope access is not allowed then remove the attribute and continue            Attribute attr = ( Attribute ) attributeList.next();            if ( ! engine.hasPermission( next, userGroups, userDn, ctx.getPrincipal().getAuthenticationLevel(),                   normName, attr.getID(), null, SEARCH_ATTRVAL_PERMS, tuples, entry ) )            {                result.getAttributes().remove( attr.getID() );                if ( attr.size() == 0 )                {                    result.getAttributes().remove( attr.getID() );                }                continue;            }            // attribute type scope is ok now let's determine value level scope            for ( int ii = 0; ii < attr.size(); ii++ )            {                if ( ! engine.hasPermission( next, userGroups, userDn,                        ctx.getPrincipal().getAuthenticationLevel(), normName,                        attr.getID(), attr.get( ii ), SEARCH_ATTRVAL_PERMS, tuples, entry ) )                {                    attr.remove( ii );                    if ( ii > 0 )                    {                        ii--;                    }                }            }        }        return true;    }