[#1051] Replicate a change made under the Relax Rules control like any other

opendj-doc-generated-ref/src/main/asciidoc/reference/appendix-controls.adoc

@@ -12,7 +12,7 @@
   information: "Portions copyright [year] [name of copyright owner]".
 
   Copyright 2017 ForgeRock AS.
-  Portions Copyright 2024 3A Systems LLC.
+  Portions Copyright 2024-2026 3A Systems LLC.
 ////
 
 :figure-caption!:
@@ -264,7 +264,10 @@ The LDAP Relax Rules Control::
 Object Identifier: 1.3.6.1.4.1.4203.666.5.12
 
 +
-Internet-Draft: link:https://tools.ietf.org/html/draft-zeilenga-ldap-relax-03[ddraft-zeilenga-ldap-relax-03 - The LDAP Relax Rules Control, window=\_top]
+Internet-Draft: link:https://tools.ietf.org/html/draft-zeilenga-ldap-relax-03[draft-zeilenga-ldap-relax-03 - The LDAP Relax Rules Control, window=\_top]
+
++
+Lets a client with the `bypass-acl` privilege add or modify attributes marked `NO-USER-MODIFICATION` or `OBSOLETE`, and skips the schema check of the resulting entry. The change is an ordinary one otherwise: it is logged, and it is replicated like any other.
 
 --
 

opendj-doc-generated-ref/src/main/docbkx/admin-guide/appendix-controls.xml

@@ -21,7 +21,7 @@
   ! CCPL HEADER END
   !
   !      Copyright 2011 ForgeRock AS
-  !      Portions copyright 2024 3A Systems,LLC.
+  !      Portions copyright 2024-2026 3A Systems,LLC.
   !    
 -->
 <appendix xml:id='appendix-controls'
@@ -457,7 +457,12 @@
     <para>Object Identifier: 1.3.6.1.4.1.4203.666.5.12</para>
     <para>Internet-Draft: <link
             xlink:href='https://tools.ietf.org/html/draft-zeilenga-ldap-relax-03'
-    >ddraft-zeilenga-ldap-relax-03 - The LDAP Relax Rules Control</link></para>
+    >draft-zeilenga-ldap-relax-03 - The LDAP Relax Rules Control</link></para>
+    <para>Lets a client with the <literal>bypass-acl</literal> privilege add
+    or modify attributes marked <literal>NO-USER-MODIFICATION</literal> or
+    <literal>OBSOLETE</literal>, and skips the schema check of the resulting
+    entry. The change is an ordinary one otherwise: it is logged, and it is
+    replicated like any other.</para>
    </listitem>
   </varlistentry>
  </variablelist>

opendj-server-legacy/src/main/java/org/opends/server/core/AddOperationBasis.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2007-2010 Sun Microsystems, Inc.
  * Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.core;
 
@@ -288,11 +289,13 @@ private final void computeObjectClassesAndAttributes()
           AttributeType attrType = attrDesc.getAttributeType();
 
           // If the attribute type is marked "NO-USER-MODIFICATION" then fail
-          // unless this is an internal operation or is related to
-          // synchronization in some way.
+          // unless this is an internal operation, is related to
+          // synchronization in some way, or the client asked for the rules
+          // to be relaxed.
           if (attrType.isNoUserModification()
               && !isInternalOperation()
-              && !isSynchronizationOperation())
+              && !isSynchronizationOperation()
+              && !isRelaxRulesRequested(this))
           {
             throw new LDAPException(LDAPResultCode.UNWILLING_TO_PERFORM,
                 ERR_ADD_ATTR_IS_NO_USER_MOD.get(entryDN, attrDesc));

opendj-server-legacy/src/main/java/org/opends/server/workflowelement/localbackend/LocalBackendAddOperation.java

@@ -110,8 +110,14 @@ public class LocalBackendAddOperation
   private Map<AttributeType, List<Attribute>> operationalAttributes;
   /** The set of user attributes for the entry to add. */
   private Map<AttributeType, List<Attribute>> userAttributes;
-  /** Indicates whether the request included the RelaxRules request control. */
-  private boolean RelaxRulesControlRequested=false;
+  /**
+   * Indicates whether the request included the Relax Rules request control, which relaxes the
+   * constraints of the schema on this change and nothing else.
+   *
+   * @see LocalBackendWorkflowElement#isRelaxRulesRequested(org.opends.server.types.Operation)
+   */
+  private final boolean relaxRules;
+
   /**
    * Creates a new operation that may be used to add a new entry in a
    * local backend of the Directory Server.
@@ -123,11 +129,7 @@ public LocalBackendAddOperation(AddOperation add)
     super(add);
 
     LocalBackendWorkflowElement.attachLocalOperation (add, this);
-  }
-
-  @Override
-  public boolean isSynchronizationOperation() {
-    return super.isSynchronizationOperation()||RelaxRulesControlRequested;
+    relaxRules = LocalBackendWorkflowElement.isRelaxRulesRequested(add);
   }
 
 
@@ -382,10 +384,11 @@ private void processAdd(ClientConnection clientConnection,
       }
 
       // If the server is configured to check schema and the
-      // operation is not a synchronization operation,
-      // check to see if the entry is valid according to the server schema,
-      // and also whether its attributes are valid according to their syntax.
-      if (DirectoryServer.getCoreConfigManager().isCheckSchema() && !isSynchronizationOperation())
+      // operation is not a synchronization operation nor one whose rules the
+      // client asked to relax, check to see if the entry is valid according to
+      // the server schema, and also whether its attributes are valid according
+      // to their syntax.
+      if (DirectoryServer.getCoreConfigManager().isCheckSchema() && !isSynchronizationOperation() && !relaxRules)
       {
         checkSchema(parentEntry);
       }
@@ -413,7 +416,7 @@ private void processAdd(ClientConnection clientConnection,
       // sensitive information to the client.
       try
       {
-        if (!getAccessControlHandler().isAllowed(this) || (RelaxRulesControlRequested && !clientConnection.hasPrivilege(Privilege.BYPASS_ACL, this)))
+        if (!getAccessControlHandler().isAllowed(this) || (relaxRules && !clientConnection.hasPrivilege(Privilege.BYPASS_ACL, this)))
         {
           setResultCodeAndMessageNoInfoDisclosure(entryDN,
               ResultCode.INSUFFICIENT_ACCESS_RIGHTS,
@@ -530,7 +533,8 @@ private boolean checkHasReadOnlyAttributes(
     {
       if (at.isNoUserModification()
           && !isInternalOperation()
-          && !isSynchronizationOperation())
+          && !isSynchronizationOperation()
+          && !relaxRules)
       {
         setResultCodeAndMessageNoInfoDisclosure(entryDN,
             ResultCode.CONSTRAINT_VIOLATION,
@@ -976,7 +980,7 @@ else if (OID_PASSWORD_POLICY_CONTROL.equals(oid))
       }
       else if (RelaxRulesControl.OID.equals(oid))
       {
-        RelaxRulesControlRequested = true;
+        // Already taken into account: see relaxRules.
       }
       else if (TransactionSpecificationRequestControl.OID.equals(oid))
       {

opendj-server-legacy/src/main/java/org/opends/server/workflowelement/localbackend/LocalBackendModifyOperation.java

@@ -126,8 +126,13 @@ public class LocalBackendModifyOperation
   private boolean permissiveModify;
   /** Indicates whether the request included the password policy request control. */
   private boolean pwPolicyControlRequested;
-  /** Indicates whether the request included the RelaxRules request control. */
-  private boolean RelaxRulesControlRequested=false;
+  /**
+   * Indicates whether the request included the Relax Rules request control, which relaxes the
+   * constraints of the schema on this change and nothing else.
+   *
+   * @see LocalBackendWorkflowElement#isRelaxRulesRequested(org.opends.server.types.Operation)
+   */
+  private final boolean relaxRules;
   /** The post-read request control, if present. */
   private LDAPPostReadRequestControl postReadRequest;
   /** The pre-read request control, if present. */
@@ -166,11 +171,7 @@ public LocalBackendModifyOperation(ModifyOperation modify)
   {
     super(modify);
     LocalBackendWorkflowElement.attachLocalOperation (modify, this);
-  }
-
-  @Override
-  public boolean isSynchronizationOperation() {
-    return super.isSynchronizationOperation()||RelaxRulesControlRequested;
+    relaxRules = LocalBackendWorkflowElement.isRelaxRulesRequested(modify);
   }
 
   /**
@@ -540,7 +541,7 @@ private boolean operationIsAllowed()
   {
     try
     {
-      if (!getAccessControlHandler().isAllowed(this) || (RelaxRulesControlRequested && !clientConnection.hasPrivilege(Privilege.BYPASS_ACL, this)))
+      if (!getAccessControlHandler().isAllowed(this) || (relaxRules && !clientConnection.hasPrivilege(Privilege.BYPASS_ACL, this)))
       {
         setResultCodeAndMessageNoInfoDisclosure(modifiedEntry,
             ResultCode.INSUFFICIENT_ACCESS_RIGHTS,
@@ -699,7 +700,7 @@ else if (OID_PASSWORD_POLICY_CONTROL.equals(oid))
       }
       else if (RelaxRulesControl.OID.equals(oid))
       {
-        RelaxRulesControlRequested = true;
+        // Already taken into account: see relaxRules.
       }
       else if (TransactionSpecificationRequestControl.OID.equals(oid))
       {
@@ -724,22 +725,23 @@ private void processNonPasswordModifications() throws DirectoryException
 
 
       // If the attribute type is marked "NO-USER-MODIFICATION" then fail unless
-      // this is an internal operation or is related to synchronization in some way.
-      final boolean isInternalOrSynchro = isInternalOrSynchro(m);
-      if (t.isNoUserModification() && !isInternalOrSynchro)
+      // this is an internal operation, is related to synchronization in some way,
+      // or the client asked for the rules to be relaxed.
+      final boolean constraintsRelaxed = isInternalOrSynchro(m) || relaxRules;
+      if (t.isNoUserModification() && !constraintsRelaxed)
       {
         throw newDirectoryException(currentEntry,
             ResultCode.CONSTRAINT_VIOLATION,
             ERR_MODIFY_ATTR_IS_NO_USER_MOD.get(entryDN, attrDesc));
       }
 
       // If the attribute type is marked "OBSOLETE" and the modification is
-      // setting new values, then fail unless this is an internal operation or
-      // is related to synchronization in some way.
+      // setting new values, then fail unless this is an internal operation,
+      // is related to synchronization in some way, or the rules are relaxed.
       if (t.isObsolete()
           && !a.isEmpty()
           && m.getModificationType() != ModificationType.DELETE
-          && !isInternalOrSynchro)
+          && !constraintsRelaxed)
       {
         throw newDirectoryException(currentEntry,
             ResultCode.CONSTRAINT_VIOLATION,
@@ -1201,7 +1203,7 @@ private void processAddModification(Attribute attr) throws DirectoryException
 
   private boolean mustCheckSchema()
   {
-    return !isSynchronizationOperation() && DirectoryServer.getCoreConfigManager().isCheckSchema();
+    return !isSynchronizationOperation() && !relaxRules && DirectoryServer.getCoreConfigManager().isCheckSchema();
   }
 
   /**

opendj-server-legacy/src/main/java/org/opends/server/workflowelement/localbackend/LocalBackendWorkflowElement.java

@@ -27,6 +27,7 @@
 import org.forgerock.opendj.ldap.DN;
 import org.forgerock.opendj.ldap.ResultCode;
 import org.forgerock.opendj.ldap.SearchScope;
+import org.forgerock.opendj.ldap.controls.RelaxRulesControl;
 import org.opends.server.api.AccessControlHandler;
 import org.opends.server.api.LocalBackend;
 import org.opends.server.controls.LDAPPostReadRequestControl;
@@ -219,6 +220,30 @@ static boolean isProxyAuthzControl(String oid)
     return OID_PROXIED_AUTH_V1.equals(oid) || OID_PROXIED_AUTH_V2.equals(oid);
   }
 
+  /**
+   * Indicates whether the provided operation carries the Relax Rules request control.
+   * <p>
+   * The control relaxes the constraints of the schema on the request - the attributes marked
+   * NO-USER-MODIFICATION or OBSOLETE, and the schema check of the resulting entry - for a
+   * client which has the {@code bypass-acl} privilege. It does not make the change a
+   * synchronization one: the change is logged, run through the plugins and replicated as any
+   * other.
+   *
+   * @param operation The operation to look at.
+   * @return {@code true} if the request carries the Relax Rules control.
+   */
+  public static boolean isRelaxRulesRequested(Operation operation)
+  {
+    for (Control c : operation.getRequestControls())
+    {
+      if (RelaxRulesControl.OID.equals(c.getOID()))
+      {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /**
    * Removes all the disallowed request controls from the provided operation.
    * <p>