Keep security and response limits visible
06A conditional operation is not encryption, permission or a resource budget. A passed assertion still enters normal LDAP processing, and the extension defines no corresponding response control.
This separate failed-assertion response carries resultCode 122 (ENUMERATED field 0A 01 7A). No corresponding Assertion response control accompanies it; other extensions are not prohibited.
Key idea: Protect sensitive filters and constrain assertion use; do not treat TRUE as authorization.
Terms
- Authorization
- Whether the requester is allowed to perform an operation.
- Administrative controls
- Server policies limiting costly uses of the mechanism.
- Response control
- An extension value attached to a response; RFC 4528 defines none corresponding to its request control.
Rules & examples
Protect sensitive filters and constrain assertion use; do not treat TRUE as authorization.
- Filters can contain sensitive information and should be appropriately protected. BER encoding is a representation, not confidentiality; RFC 4528 itself adds no encryption.
- The mechanism can reveal directory contents through assertions, so it SHOULD be subject to appropriate access controls. A passing assertion does not bypass the normal operation’s authorization/schema constraints.
- The illustrated normal failure is insufficientAccessRights(50) after a TRUE assertion. It is a possible ordinary LDAP error, not a required ordering of all server checks or a new RFC 4528 code.
- Complex assertions can consume time and resources; RFC 4528 says the mechanism SHOULD be subject to appropriate administrative controls. It specifies no universal time/size budget or new resource-error code here.
- There is no corresponding Assertion response control (§3). Result codes belong to the normal LDAP response; other extensions may define their own response controls. The illustrated 122 field is not an entire LDAPResult encoding.
The helper does not implement LDAP access-control policy, filter complexity evaluation, encryption or a complete wire response. The gates show required distinctions and explicitly illustrative policy outcomes, never actual directory queries or private entries.
Sources
New to this? Start hereA quick picture + helpful background
Check the entry before changing it
Think of a shared directory card: a remembered value may be out of date by the time someone changes it. A conditional update asks the server to check the current card and perform the update as one action. This is an analogy for one operation, not a promise of a transaction across the whole directory.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.