Encode a request control, not filter text
02A control is an option attached to one LDAP request. Its identifier selects the option; its value carries an encoded condition. Basic Encoding Rules (BER) describe typed, length-delimited bytes.
Critical TRUE uses 01 01 FF. FALSE is legal but its default-valued field is absent. Whether an unsupported control is ignored depends on this flag.
Key idea: controlType is 1.3.6.1.1.12; controlValue contains a BER-encoded Filter.
Terms
- BER
- Basic Encoding Rules: tags, lengths and content octets for ASN.1 values.
- OCTET STRING
- A field containing a sequence of bytes.
- OID
- Object identifier: the dotted identifier naming this control.
Rules & examples
controlType is 1.3.6.1.1.12; controlValue contains a BER-encoded Filter.
- RFC 4528 defines controlType 1.3.6.1.1.12. The controlValue is a BER-encoded LDAP Filter, not the UTF-8 bytes of a parenthesized filter string. RFC 4515 provides readable string notation separately.
- The example equalityMatch Filter for (description=ready) uses context-specific constructed tag A3 and directly contains the attribute-description and assertion-value OCTET STRINGs. Its length is 20 content octets; the complete Filter has 22 octets.
- The controlValue OCTET STRING wraps those 22 Filter octets. The outer Control is a SEQUENCE, with the controlType encoded as dotted-decimal LDAPOID text in an OCTET STRING, not the ASN.1 OBJECT IDENTIFIER tag.
- Criticality may legally be TRUE or FALSE. Under RFC 4511 §5.1, TRUE’s Boolean content octet is FF; a field at its DEFAULT value FALSE is omitted. The diagram separates the flags without claiming FALSE is forbidden.
- The encoder obeys definite-length and primitive OCTET STRING rules. Clients MUST send values valid for the attribute’s syntax (RFC 4511 §4.1.5). Encoding arbitrary test octets does not make them valid description values.
Hexadecimal bytes are real for this equality example. The field layout is schematic, not to-scale packet widths or a complete LDAPMessage. The helper supports only a bounded equality encoder, not all Filter alternatives or a generic LDAP parser.
Sources
New to this? Start hereA quick picture + helpful background
Check the entry before changing it
Think of a shared directory card: a remembered value may be out of date by the time someone changes it. A conditional update asks the server to check the current card and perform the update as one action. This is an analogy for one operation, not a promise of a transaction across the whole directory.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.