ITS#3056 partial fix - from a slurpd perspective, the updatedn

should be allowed to the entry at the naming prefix (database suffix).

servers/slapd/back-bdb/add.c

@@ -298,7 +298,7 @@ retry:	/* transaction retry */
 		 * no parent!
 		 *  if not attempting to add entry at suffix or with parent ""
 		 */
-		if (( !be_isroot( op ) || pdn.bv_len > 0 )
+		if ((( !be_isroot( op ) && !be_isupdate(op)) || pdn.bv_len > 0 )
 			&& !is_entry_glue( op->oq_add.rs_e ))
 		{
 #ifdef NEW_LOGGING

servers/slapd/back-ldbm/add.c

@@ -247,8 +247,8 @@ ldbm_back_add(
 	} else {
 		assert( pdn.bv_val == NULL || *pdn.bv_val == '\0' );
 
-		if ( !be_isroot( op )
-			&& !is_entry_glue( op->oq_add.rs_e ))
+		if (( !be_isroot( op ) && !be_isupdate( op )) &&
+			!is_entry_glue( op->oq_add.rs_e ))
 		{
 			ldap_pvt_thread_rdwr_wunlock(&li->li_giant_rwlock);