Set userGroups = groupCache.getGroups( userName.toString() );
Set userGroups = groupCache.getGroups( principalDn.toString() );
    public void move( NextInterceptor next, LdapDN oriChildName, LdapDN newParentName, String newRn, boolean deleteOldRn )        throws NamingException    {        // Access the principal requesting the operation, and bypass checks if it is the admin        Invocation invocation = InvocationStack.getInstance().peek();        PartitionNexusProxy proxy = invocation.getProxy();        Attributes entry = proxy.lookup( oriChildName, PartitionNexusProxy.LOOKUP_BYPASS );        LdapPrincipal principal = ( ( ServerContext ) invocation.getCaller() ).getPrincipal();        LdapDN userName = principal.getJndiName();        LdapDN newName = ( LdapDN ) newParentName.clone();        newName.add( newRn );        // bypass authz code if we are disabled        if ( !enabled )        {            next.move( oriChildName, newParentName, newRn, deleteOldRn );            return;        }        // bypass authz code but manage caches if operation is performed by the admin        if ( userName.toString().equalsIgnoreCase( PartitionNexus.ADMIN_PRINCIPAL_NORMALIZED ) )        {            next.move( oriChildName, newParentName, newRn, deleteOldRn );            tupleCache.subentryRenamed( oriChildName, newName );            groupCache.groupRenamed( oriChildName, newName );            return;        }        Set userGroups = groupCache.getGroups( userName.toString() );        Collection tuples = new HashSet();        addPerscriptiveAciTuples( proxy, tuples, oriChildName, entry );        addEntryAciTuples( tuples, entry );        addSubentryAciTuples( proxy, tuples, oriChildName, entry );        engine.checkPermission( proxy, userGroups, userName, principal.getAuthenticationLevel(), oriChildName, null,            null, MOVERENAME_PERMS, tuples, entry );        // Get the entry again without operational attributes        // because access control subentry operational attributes        // will not be valid at the new location.        // This will certainly be fixed by the SubentryService,        // but after this service.        Attributes importedEntry = proxy.lookup( oriChildName, PartitionNexusProxy.LOOKUP_EXCLUDING_OPR_ATTRS_BYPASS );        // As the target entry does not exist yet and so        // its subentry operational attributes are not there,        // we need to construct an entry to represent it        // at least with minimal requirements which are object class        // and access control subentry operational attributes.        SubentryService subentryService = ( SubentryService ) chain.get( "subentryService" );        Attributes subentryAttrs = subentryService.getSubentryAttributes( newName, importedEntry );        NamingEnumeration attrList = importedEntry.getAll();        while ( attrList.hasMore() )        {            subentryAttrs.put( ( Attribute ) attrList.next() );        }                Collection destTuples = new HashSet();        // Import permission is only valid for prescriptive ACIs        addPerscriptiveAciTuples( proxy, destTuples, newName, subentryAttrs );        // Evaluate the target context to see whether it        // allows an entry named newName to be imported as a subordinate.        engine.checkPermission( proxy, userGroups, userName, principal.getAuthenticationLevel(), newName, null,            null, IMPORT_PERMS, destTuples, subentryAttrs );        //        if ( deleteOldRn )        //        {        //            String oldRn = oriChildName.get( oriChildName.size() - 1 );        //            if ( NamespaceTools.hasCompositeComponents( oldRn ) )        //            {        //                String[] comps = NamespaceTools.getCompositeComponents( oldRn );        //                for ( int ii = 0; ii < comps.length; ii++ )        //                {        //                    String id = NamespaceTools.getRdnAttribute( comps[ii] );        //                    String value = NamespaceTools.getRdnValue( comps[ii] );        //                    engine.checkPermission( next, userGroups, user.getJndiName(),        //                            user.getAuthenticationLevel(), oriChildName, id,        //                            value, Collections.singleton( MicroOperation.REMOVE ),        //                            tuples, entry );        //                }        //            }        //            else        //            {        //                String id = NamespaceTools.getRdnAttribute( oldRn );        //                String value = NamespaceTools.getRdnValue( oldRn );        //                engine.checkPermission( next, userGroups, user.getJndiName(),        //                        user.getAuthenticationLevel(), oriChildName, id,        //                        value, Collections.singleton( MicroOperation.REMOVE ),        //                        tuples, entry );        //            }        //        }        next.move( oriChildName, newParentName, newRn, deleteOldRn );        tupleCache.subentryRenamed( oriChildName, newName );        groupCache.groupRenamed( oriChildName, newName );    }