engine.checkPermission( proxy, userGroups, user.getJndiName(), user.getAuthenticationLevel(), normName, attr.getID(),
engine.checkPermission( proxy, userGroups, userName, principal.getAuthenticationLevel(), normName, attr.getID(),
    public void add( NextInterceptor next, String upName, Name normName, Attributes entry ) throws NamingException    {        // Access the principal requesting the operation, and bypass checks if it is the admin        Invocation invocation = InvocationStack.getInstance().peek();        LdapPrincipal user = ( ( ServerContext ) invocation.getCaller() ).getPrincipal();        // bypass authz code if we are disabled        if ( ! enabled )        {            next.add( upName, normName, entry );            return;        }        // bypass authz code but manage caches if operation is performed by the admin        if ( user.getName().equalsIgnoreCase( DirectoryPartitionNexus.ADMIN_PRINCIPAL ) )        {            next.add( upName, normName, entry );            tupleCache.subentryAdded( upName, normName, entry );            groupCache.groupAdded( upName, normName, entry );            return;        }        // perform checks below here for all non-admin users        SubentryService subentryService = ( SubentryService ) chain.get( "subentryService" );        Attributes subentryAttrs = subentryService.getSubentryAttributes( normName, entry );        NamingEnumeration attrList = entry.getAll();        while( attrList.hasMore() )        {            subentryAttrs.put( ( Attribute ) attrList.next() );        }        // Assemble all the information required to make an access control decision        Set userGroups = groupCache.getGroups( user.getName() );        Collection tuples = new HashSet();        // Build the total collection of tuples to be considered for add rights        // NOTE: entryACI are NOT considered in adds (it would be a security breech)        addPerscriptiveAciTuples( invocation.getProxy(), tuples, normName, subentryAttrs );        addSubentryAciTuples( invocation.getProxy(), tuples, normName, subentryAttrs );        // check if entry scope permission is granted        DirectoryPartitionNexusProxy proxy = invocation.getProxy();        engine.checkPermission( proxy, userGroups, user.getJndiName(), user.getAuthenticationLevel(),                normName, null, null, ADD_PERMS, tuples, subentryAttrs );        // now we must check if attribute type and value scope permission is granted        NamingEnumeration attributeList = entry.getAll();        while ( attributeList.hasMore() )        {            Attribute attr = ( Attribute ) attributeList.next();            for ( int ii = 0; ii < attr.size(); ii++ )            {                engine.checkPermission( proxy, userGroups, user.getJndiName(),                        user.getAuthenticationLevel(), normName, attr.getID(),                        attr.get( ii ), ADD_PERMS, tuples, entry );            }        }        // if we've gotten this far then access has been granted        next.add( upName, normName, entry );        // if the entry added is a subentry or a groupOf[Unique]Names we must        // update the ACITuple cache and the groups cache to keep them in sync        tupleCache.subentryAdded( upName, normName, entry );        groupCache.groupAdded( upName, normName, entry );    }