/*
 *  Licensed to the Apache Software Foundation (ASF) under one
 *  or more contributor license agreements.  See the NOTICE file
 *  distributed with this work for additional information
 *  regarding copyright ownership.  The ASF licenses this file
 *  to you under the Apache License, Version 2.0 (the
 *  "License"); you may not use this file except in compliance
 *  with the License.  You may obtain a copy of the License at
 *  
 *    http://www.apache.org/licenses/LICENSE-2.0
 *  
 *  Unless required by applicable law or agreed to in writing,
 *  software distributed under the License is distributed on an
 *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 *  KIND, either express or implied.  See the License for the
 *  specific language governing permissions and limitations
 *  under the License. 
 *  
 */
package org.apache.directory.server.core.authz;


import org.apache.directory.shared.ldap.exception.LdapNoPermissionException;
import org.apache.directory.shared.ldap.message.LockableAttributeImpl;
import org.apache.directory.shared.ldap.message.LockableAttributesImpl;
import org.apache.directory.shared.ldap.message.ModificationItemImpl;
import org.apache.directory.shared.ldap.name.LdapDN;

import javax.naming.NamingException;
import javax.naming.NamingEnumeration;
import javax.naming.Name;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.BasicAttributes;
import javax.naming.directory.DirContext;

import java.util.List;
import java.util.ArrayList;


/**
 * Tests whether or not authorization around entry modify operations work properly.
 *
 * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
 * @version $Rev$
 */
public class ModifyAuthorizationITest extends AbstractAuthorizationITest
{
    /**
     * Checks if an attribute of a simple entry (an organizationalUnit) with an RDN
     * relative to ou=system can be modified by a specific non-admin user.  If a
     * permission exception is encountered it is caught and false is returned,
     * otherwise true is returned.  The entry is deleted after being created just in case
     * subsequent calls to this method are made in the same test case: the admin account
     * is used to add and delete this test entry so permissions to add and delete are not
     * required to test the modify operation by the user.
     *
     * @param uid the unique identifier for the user (presumed to exist under ou=users,ou=system)
     * @param password the password of this user
     * @param entryRdn the relative DN, relative to ou=system where entry is created
     * for modification test
     * @param mods the modifications to make to the entry
     * @return true if the modifications can be made by the user at the specified location,
     * false otherwise.
     * @throws javax.naming.NamingException if there are problems conducting the test
     */
    public boolean checkCanModifyAs( String uid, String password, String entryRdn, ModificationItemImpl[] mods )
        throws NamingException
    {
        // create the entry with the telephoneNumber attribute to modify
        Attributes testEntry = new LockableAttributesImpl( "ou", "testou", true );
        Attribute objectClass = new LockableAttributeImpl( "objectClass" );
        testEntry.put( objectClass );
        objectClass.add( "top" );
        objectClass.add( "organizationalUnit" );
        testEntry.put( "telephoneNumber", "867-5309" ); // jenny don't change your number

        DirContext adminContext = getContextAsAdmin();

        try
        {
            // create the entry as admin
            LdapDN userName = new LdapDN( "uid=" + uid + ",ou=users,ou=system" );
            adminContext.createSubcontext( entryRdn, testEntry );

            // modify the entry as the user
            DirContext userContext = getContextAs( userName, password );
            userContext.modifyAttributes( entryRdn, mods );

            return true;
        }
        catch ( LdapNoPermissionException e )
        {
            return false;
        }
        finally
        {
            // let's clean up
            adminContext.destroySubcontext( entryRdn );
        }
    }


    /**
     * Checks if an attribute of a simple entry (an organizationalUnit) with an RDN
     * relative to ou=system can be modified by a specific non-admin user.  If a
     * permission exception is encountered it is caught and false is returned,
     * otherwise true is returned.  The entry is deleted after being created just in case
     * subsequent calls to this method are made in the same test case: the admin account
     * is used to add and delete this test entry so permissions to add and delete are not
     * required to test the modify operation by the user.
     *
     * @param uid the unique identifier for the user (presumed to exist under ou=users,ou=system)
     * @param password the password of this user
     * @param entryRdn the relative DN, relative to ou=system where entry is created
     * for modification test
     * @param mods the attributes to modify in the entry
     * @param modOp the modification operation to use for all attributes
     * @return true if the modifications can be made by the user at the specified location,
     * false otherwise.
     * @throws javax.naming.NamingException if there are problems conducting the test
     */
    public boolean checkCanModifyAs( String uid, String password, String entryRdn, int modOp, Attributes mods )
        throws NamingException
    {
        // create the entry with the telephoneNumber attribute to modify
        Attributes testEntry = new LockableAttributesImpl( "ou", "testou", true );
        Attribute objectClass = new LockableAttributeImpl( "objectClass" );
        testEntry.put( objectClass );
        objectClass.add( "top" );
        objectClass.add( "organizationalUnit" );
        testEntry.put( "telephoneNumber", "867-5309" ); // jenny don't change your number

        DirContext adminContext = getContextAsAdmin();

        try
        {
            // create the entry as admin
            LdapDN userName = new LdapDN( "uid=" + uid + ",ou=users,ou=system" );
            adminContext.createSubcontext( entryRdn, testEntry );

            // modify the entry as the user
            DirContext userContext = getContextAs( userName, password );
            userContext.modifyAttributes( entryRdn, modOp, mods );

            return true;
        }
        catch ( LdapNoPermissionException e )
        {
            return false;
        }
        finally
        {
            // let's clean up
            adminContext.destroySubcontext( entryRdn );
        }
    }


    /**
     * Checks if a user can modify an attribute of their own entry.  Users are
     * presumed to reside under ou=users,ou=system.  If a permission exception is
     * encountered it is caught and false is returned, otherwise true is returned.
     *
     * @param uid the unique identifier for the user (presumed to exist under ou=users,ou=system)
     * @param password the password of this user
     * @param mods the attributes to modify in the entry
     * @param modOp the modification operation to use for all attributes
     * @return true if the modifications can be made by the user his/her own entry,
     * false otherwise.
     * @throws javax.naming.NamingException if there are problems conducting the test
     */
    public boolean checkCanSelfModify( String uid, String password, int modOp, Attributes mods ) throws NamingException
    {
        try
        {
            // modify the entry as the user
            Name userEntry = new LdapDN( "uid=" + uid + ",ou=users,ou=system" );
            DirContext userContext = getContextAs( userEntry, password, userEntry.toString() );
            userContext.modifyAttributes( "", modOp, mods );
            return true;
        }
        catch ( LdapNoPermissionException e )
        {
            return false;
        }
    }


    /**
     * Checks if a user can modify an attribute of their own entry.  Users are
     * presumed to reside under ou=users,ou=system.  If a permission exception is
     * encountered it is caught and false is returned, otherwise true is returned.
     *
     * @param uid the unique identifier for the user (presumed to exist under ou=users,ou=system)
     * @param password the password of this user
     * @param mods the attributes to modify in the entry
     * @return true if the modifications can be made by the user his/her own entry,
     * false otherwise.
     * @throws javax.naming.NamingException if there are problems conducting the test
     */
    public boolean checkCanSelfModify( String uid, String password, ModificationItemImpl[] mods ) throws NamingException
    {
        try
        {
            // modify the entry as the user
            Name userEntry = new LdapDN( "uid=" + uid + ",ou=users,ou=system" );
            DirContext userContext = getContextAs( userEntry, password, userEntry.toString() );
            userContext.modifyAttributes( "", mods );
            return true;
        }
        catch ( LdapNoPermissionException e )
        {
            return false;
        }
    }


    /**
     * Converts a set of attributes and a modification operation type into a MoficationItem array.
     *
     * @param modOp the modification operation to perform
     * @param changes the modifications to the attribute
     * @return the array of modification items represting the changes
     * @throws NamingException if there are problems accessing attributes
     */
    private ModificationItemImpl[] toItems( int modOp, Attributes changes ) throws NamingException
    {
        List mods = new ArrayList();
        NamingEnumeration list = changes.getAll();
        while ( list.hasMore() )
        {
            Attribute attr = ( Attribute ) list.next();
            mods.add( new ModificationItemImpl( modOp, attr ) );
        }
        ModificationItemImpl[] modArray = new ModificationItemImpl[mods.size()];
        return ( ModificationItemImpl[] ) mods.toArray( modArray );
    }


    public void testSelfModification() throws NamingException
    {
        // ----------------------------------------------------------------------------------
        // Modify with Attribute Addition
        // ----------------------------------------------------------------------------------

        // create the non-admin user
        createUser( "billyd", "billyd" );

        // create the password modification
        ModificationItemImpl[] mods = toItems( DirContext.REPLACE_ATTRIBUTE, new LockableAttributesImpl( "userPassword",
            "williams", true ) );

        // try a modify operation which should fail without any ACI
        assertFalse( checkCanSelfModify( "billyd", "billyd", mods ) );

        // Gives grantModify, and grantRead perm to all users in the Administrators group for
        // entries and all attribute types and values
        createAccessControlSubentry( "selfModifyUserPassword", "{ " + "identificationTag \"addAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { thisEntry }, " + "userPermissions { "
            + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse, grantRead } }, "
            + "{ protectedItems {allAttributeValues {userPassword}}, grantsAndDenials { grantAdd, grantRemove } } "
            + "} } }" );

        // try a modify operation which should succeed with ACI
        assertTrue( checkCanSelfModify( "billyd", "billyd", mods ) );
        deleteAccessControlSubentry( "selfModifyUserPassword" );
    }


    /**
     * Checks to make sure group membership based userClass works for modify operations.
     *
     * @throws javax.naming.NamingException if the test encounters an error
     */
    public void testGrantModifyByTestGroup() throws NamingException
    {
        // ----------------------------------------------------------------------------------
        // Modify with Attribute Addition
        // ----------------------------------------------------------------------------------

        // create the add modifications
        ModificationItemImpl[] mods = toItems( DirContext.ADD_ATTRIBUTE, new LockableAttributesImpl( "registeredAddress",
            "100 Park Ave.", true ) );

        // create the non-admin user
        createUser( "billyd", "billyd" );
        
        createGroup( "TestGroup" );

        // try a modify operation which should fail without any ACI
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );

        // Gives grantModify, and grantRead perm to all users in the TestGroup group for
        // entries and all attribute types and values
        createAccessControlSubentry( "administratorModifyAdd", "{ " + "identificationTag \"addAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
            + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
            + "{ protectedItems {attributeType {registeredAddress}, allAttributeValues {registeredAddress}}, grantsAndDenials { grantAdd } } " + "} } }" );

        // see if we can now add that test entry which we could not before
        // add op should still fail since billd is not in the admin group
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );

        // now add billyd to the TestGroup group and try again
        addUserToGroup( "billyd", "TestGroup" );

        // try a modify operation which should succeed with ACI and group membership change
        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
        deleteAccessControlSubentry( "administratorModifyAdd" );

        // ----------------------------------------------------------------------------------
        // Modify with Attribute Removal
        // ----------------------------------------------------------------------------------

        // now let's test to see if we can perform a modify with a delete op
        mods = toItems( DirContext.REMOVE_ATTRIBUTE, new LockableAttributesImpl( "telephoneNumber", "867-5309", true ) );

        // make sure we cannot remove the telephone number from the test entry
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );

        // Gives grantModify, and grantRead perm to all users in the TestGroup group for
        // entries and all attribute types and values
        createAccessControlSubentry( "administratorModifyRemove", "{ " + "identificationTag \"addAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
            + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
            + "{ protectedItems {attributeType {telephoneNumber}, allAttributeValues {telephoneNumber}}, grantsAndDenials { grantRemove } } " + "} } }" );

        // try a modify operation which should succeed with ACI and group membership change
        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
        deleteAccessControlSubentry( "administratorModifyRemove" );

        // ----------------------------------------------------------------------------------
        // Modify with Attribute Replace (requires both grantRemove and grantAdd on attrs)
        // ----------------------------------------------------------------------------------

        // now let's test to see if we can perform a modify with a delete op
        mods = toItems( DirContext.REPLACE_ATTRIBUTE, new LockableAttributesImpl( "telephoneNumber", "867-5309", true ) );

        // make sure we cannot remove the telephone number from the test entry
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );

        // Gives grantModify, and grantRead perm to all users in the TestGroup group for
        // entries and all attribute types and values
        createAccessControlSubentry( "administratorModifyReplace", "{ " + "identificationTag \"addAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
            + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
            + "{ protectedItems {attributeType {registeredAddress}, allAttributeValues {telephoneNumber}}, grantsAndDenials { grantAdd, grantRemove } } "
            + "} } }" );

        // try a modify operation which should succeed with ACI and group membership change
        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
        deleteAccessControlSubentry( "administratorModifyReplace" );

        /* =================================================================================
         *              DO IT ALL OVER AGAIN BUT USE THE OTHER MODIFY METHOD
         * ================================================================================= */

        // ----------------------------------------------------------------------------------
        // Modify with Attribute Addition
        // ----------------------------------------------------------------------------------
        // create the add modifications
        Attributes changes = new LockableAttributesImpl( "registeredAddress", "100 Park Ave.", true );

        // try a modify operation which should fail without any ACI
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.ADD_ATTRIBUTE, changes ) );

        // Gives grantModify, and grantRead perm to all users in the TestGroup group for
        // entries and all attribute types and values
        createAccessControlSubentry( "administratorModifyAdd", "{ " + "identificationTag \"addAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
            + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
            + "{ protectedItems {attributeType {registeredAddress}, allAttributeValues {registeredAddress}}, grantsAndDenials { grantAdd } } " + "} } }" );

        // try a modify operation which should succeed with ACI and group membership change
        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.ADD_ATTRIBUTE, changes ) );
        deleteAccessControlSubentry( "administratorModifyAdd" );

        // ----------------------------------------------------------------------------------
        // Modify with Attribute Removal
        // ----------------------------------------------------------------------------------

        // now let's test to see if we can perform a modify with a delete op
        changes = new LockableAttributesImpl( "telephoneNumber", "867-5309", true );

        // make sure we cannot remove the telephone number from the test entry
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.REMOVE_ATTRIBUTE, changes ) );

        // Gives grantModify, and grantRead perm to all users in the TestGroup group for
        // entries and all attribute types and values
        createAccessControlSubentry( "administratorModifyRemove", "{ " + "identificationTag \"addAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
            + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
            + "{ protectedItems {attributeType {telephoneNumber}, allAttributeValues {telephoneNumber}}, grantsAndDenials { grantRemove } } " + "} } }" );

        // try a modify operation which should succeed with ACI and group membership change
        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.REMOVE_ATTRIBUTE, changes ) );
        deleteAccessControlSubentry( "administratorModifyRemove" );

        // ----------------------------------------------------------------------------------
        // Modify with Attribute Replace (requires both grantRemove and grantAdd on attrs)
        // ----------------------------------------------------------------------------------

        // now let's test to see if we can perform a modify with a delete op
        changes = new LockableAttributesImpl( "telephoneNumber", "867-5309", true );

        // make sure we cannot remove the telephone number from the test entry
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.REPLACE_ATTRIBUTE, changes ) );

        // Gives grantModify, and grantRead perm to all users in the TestGroup group for
        // entries and all attribute types and values
        createAccessControlSubentry( "administratorModifyReplace", "{ " + "identificationTag \"addAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
            + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
            + "{ protectedItems {attributeType {registeredAddress}, allAttributeValues {telephoneNumber}}, grantsAndDenials { grantAdd, grantRemove } } "
            + "} } }" );

        // try a modify operation which should succeed with ACI and group membership change
        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.REPLACE_ATTRIBUTE, changes ) );
        deleteAccessControlSubentry( "administratorModifyReplace" );
    }


    //    /**
    //     * Checks to make sure name based userClass works for modify operations.
    //     *
    //     * @throws javax.naming.NamingException if the test encounters an error
    //     */
    //    public void testGrantModifyByName() throws NamingException
    //    {
    //        // create the non-admin user
    //        createUser( "billyd", "billyd" );
    //
    //        // try an modify operation which should fail without any ACI
    //        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", "867-5309" ) );
    //
    //        // now add a subentry that enables user billyd to modify an entry below ou=system
    //        createAccessControlSubentry( "billydAdd", "{ " +
    //                "identificationTag \"addAci\", " +
    //                "precedence 14, " +
    //                "authenticationLevel none, " +
    //                "itemOrUserFirst userFirst: { " +
    //                "userClasses { name { \"uid=billyd,ou=users,ou=system\" } }, " +
    //                "userPermissions { { " +
    //                "protectedItems {entry, allUserAttributeTypesAndValues}, " +
    //                "grantsAndDenials { grantModify, grantRead, grantBrowse } } } } }" );
    //
    //        // should work now that billyd is authorized by name
    //        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", "867-5309" ) );
    //    }
    //
    //
    //    /**
    //     * Checks to make sure subtree based userClass works for modify operations.
    //     *
    //     * @throws javax.naming.NamingException if the test encounters an error
    //     */
    //    public void testGrantModifyBySubtree() throws NamingException
    //    {
    //        // create the non-admin user
    //        createUser( "billyd", "billyd" );
    //
    //        // try a modify operation which should fail without any ACI
    //        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", "867-5309" ) );
    //
    //        // now add a subentry that enables user billyd to modify an entry below ou=system
    //        createAccessControlSubentry( "billyAddBySubtree", "{ " +
    //                "identificationTag \"addAci\", " +
    //                "precedence 14, " +
    //                "authenticationLevel none, " +
    //                "itemOrUserFirst userFirst: { " +
    //                "userClasses { subtree { { base \"ou=users,ou=system\" } } }, " +
    //                "userPermissions { { " +
    //                "protectedItems {entry, allUserAttributeTypesAndValues}, " +
    //                "grantsAndDenials { grantModify, grantRead, grantBrowse } } } } }" );
    //
    //        // should work now that billyd is authorized by the subtree userClass
    //        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", "867-5309" ) );
    //    }
    //
    //
    //    /**
    //     * Checks to make sure <b>allUsers</b> userClass works for modify operations.
    //     *
    //     * @throws javax.naming.NamingException if the test encounters an error
    //     */
    //    public void testGrantModifyAllUsers() throws NamingException
    //    {
    //        // create the non-admin user
    //        createUser( "billyd", "billyd" );
    //
    //        // try an add operation which should fail without any ACI
    //        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", "867-5309" ) );
    //
    //        // now add a subentry that enables anyone to add an entry below ou=system
    //        createAccessControlSubentry( "anybodyAdd", "{ " +
    //                "identificationTag \"addAci\", " +
    //                "precedence 14, " +
    //                "authenticationLevel none, " +
    //                "itemOrUserFirst userFirst: { " +
    //                "userClasses { allUsers }, " +
    //                "userPermissions { { " +
    //                "protectedItems {entry, allUserAttributeTypesAndValues}, " +
    //                "grantsAndDenials { grantModify, grantRead, grantBrowse } } } } }" );
    //
    //        // see if we can now modify that test entry's number which we could not before
    //        // should work with billyd now that all users are authorized
    //        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", "867-5309" ) );
    //    }


    public void testPresciptiveACIModification() throws NamingException
    {
        
        ModificationItemImpl[] mods = toItems( DirContext.ADD_ATTRIBUTE,
            new LockableAttributesImpl( "registeredAddress", "100 Park Ave.", true ) );

        createUser( "billyd", "billyd" );

        createAccessControlSubentry( "modifyACI", "{ " + "identificationTag \"modifyAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { allUsers }, " + "userPermissions { "
            + "{ protectedItems {entry, allUserAttributeTypesAndValues}, grantsAndDenials { grantModify, grantBrowse, grantAdd, grantRemove } } } } }" );

        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
        
        mods = toItems( DirContext.REPLACE_ATTRIBUTE,
            new LockableAttributesImpl( "registeredAddress", "200 Park Ave.", true ) );
        
        changePresciptiveACI( "modifyACI", "{ " + "identificationTag \"modifyAci\", "
            + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
            + "userClasses { allUsers }, " + "userPermissions { "
            + "{ protectedItems {entry, allUserAttributeTypesAndValues}, grantsAndDenials { denyModify } } } } }" );

        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
        
        deleteAccessControlSubentry( "modifyACI" );
        
    }
    
    
    public void testMaxValueCountProtectedItem() throws NamingException
    {
        createUser( "billyd", "billyd" );
        createAccessControlSubentry( "mvcACI",
            " {" +
                " identificationTag \"mvcACI\"," +
                " precedence 10," +
                " authenticationLevel simple," +
                " itemOrUserFirst userFirst:" + 
                " {" +
                    " userClasses { allUsers }," +
                    " userPermissions" + 
                    " {" +
                        " {" +
                            " protectedItems { entry }," +
                            " grantsAndDenials { grantModify, grantBrowse }" +
                        " }" +
                        " ," +
                        " {" +
                            " protectedItems" + 
                            " {" +
                                " attributeType { description }," +
                                " allAttributeValues { description }," +
                                " maxValueCount" + 
                                " {" +
                                    " { type description, maxCount 1 }" + 
                                " }" +
                            " }" +
                            " ," +
                            " grantsAndDenials" + 
                            " {" +
                                " grantRemove," +
                                " grantAdd" +
                            " }" +
                        " }" +
                     " }" +
                " }" +
            " }" );
        
        ModificationItemImpl[] mods = toItems( DirContext.ADD_ATTRIBUTE,
            new BasicAttributes( "description", "description 1", true ) );
        
        assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
        
        Attributes attrs = new BasicAttributes(true);
        Attribute attr = new BasicAttribute( "description" );
        attr.add( "description 1" );
        attr.add( "description 2" );
        attrs.put( attr );
        mods = toItems( DirContext.ADD_ATTRIBUTE, attrs );
        
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
        
        mods = toItems( DirContext.REPLACE_ATTRIBUTE, attrs );
        
        assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
    }
    
}