RFC 4528 / START HERE
LDAP assertion control, before the details
LDAP means Lightweight Directory Access Protocol; an assertion is a condition that must hold before a request proceeds.
A directory stores named entries with attributes and values. RFC 4528 lets a client attach a condition to an operation so the server can refuse to proceed when that condition is not true.
Why it exists
A separate read can become stale before a later write. For updates and comparisons, this control makes the condition check integral to the operation. Searches instead test their base entry before searching. A passed condition still does not promise permission, success or a whole-directory snapshot.
A familiar example
A fictional picnic entry was ready when a client read it, but another client changed it to busy. A guarded request asking to replace ready with done fails without overwriting busy. A separate matching request may proceed normally. The guide explains the encoded control, result codes, support discovery and criticality.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Check and change as one actionA directory stores entries: named objects with attributes and values. Lightweight Directory Access Protocol (LDAP) lets a client operate on those entries. An assertion is a condition the server checks before proceeding.→
- Encode a request control, not filter textA control is an option attached to one LDAP request. Its identifier selects the option; its value carries an encoded condition. Basic Encoding Rules (BER) describe typed, length-delimited bytes.→
- Choose the target and interpret the resultThe condition belongs to a specific target entry named by the request. Different operations use different target fields. Filter evaluation has three outcomes, and only TRUE opens normal processing.→
- Test the Search base before searchingA Search has a base entry, a scope and a normal search filter. The assertion tests the base after it is found and before the search begins; it is not an extra filter applied independently to each candidate.→
- Discover support and choose criticalityThe root DSE is the server-information entry. It can advertise supported request controls. Criticality tells the server whether the client accepts running the operation without a control it cannot or will not apply.→
- Keep security and response limits visibleA conditional operation is not encryption, permission or a resource budget. A passed assertion still enters normal LDAP processing, and the extension defines no corresponding response control.→
This introduction explains RFC 4528 (2006). Read the original RFC ↗