LDAP Controls
Controls provide a mechanism whereby the semantics and arguments of existing LDAP operations may be extended. One or more controls may be attached to a single LDAP message. A control only affects the semantics of the message it is attached to. Controls sent by clients are termed request controls, and those sent by servers are termed response controls.
OpenDJ software supports the following LDAP controls:
- Account Usability Control
-
Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.8
Control originally provided by Sun Microsystems, used to determine whether a user account can be used to authenticate to the directory.
- Assertion request control
-
Object Identifier: 1.3.6.1.1.12
- Entry Change Notification response control
-
Object Identifier: 2.16.840.1.113730.3.4.7
- Get Effective Rights request control
-
Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.2
Internet-Draft: draft-ietf-ldapext-acl-model - Access Control Model for LDAPv3
- Manage DSAIT request control
-
Object Identifier: 2.16.840.1.113730.3.4.2
- Matched Values request control
-
Object Identifier: 1.2.826.0.1.3344810.2.3
- No-Op Control
-
Object Identifier: 1.3.6.1.4.1.4203.1.10.2
Internet-Draft: draft-zeilenga-ldap-noop - LDAP No-Op Control
- Password Expired response control
-
Object Identifier: 2.16.840.1.113730.3.4.4
- Password Expiring response control
-
Object Identifier: 2.16.840.1.113730.3.4.5
- Password Policy response control
-
Object Identifier: 1.3.6.1.4.1.42.2.27.8.5.1
- Permissive Modify request control
-
Object Identifier: 1.2.840.113556.1.4.1413
Microsoft defined this control that, "Allows an LDAP modify to work under less restrictive conditions. Without it, a delete will fail if an attribute done not exist, and an add will fail if an attribute already exists. No data is needed in this control." (source of quote)
- Persistent Search request control
-
Object Identifier: 2.16.840.1.113730.3.4.3
- Post-Read request control
-
Object Identifier: 1.3.6.1.1.13.2
- Post-Read response control
-
Object Identifier: 1.3.6.1.1.13.2
- Pre-Read request control
-
Object Identifier: 1.3.6.1.1.13.1
- Pre-Read response control
-
Object Identifier: 1.3.6.1.1.13.1
- Proxied Authorization v2 request control
-
Object Identifier: 2.16.840.1.113730.3.4.18
- Public Changelog Exchange Control
-
Object Identifier: 1.3.6.1.4.1.26027.1.5.4
OpenDJ specific, for using the bookmark cookie when reading the external change log.
- Replication Repair request control
-
Object Identifier: 1.3.6.1.4.1.26027.1.5.2
OpenDJ specific, for writing the attributes replication owns, such as
entryUUIDandds-sync-hist, on the replica the request is sent to, and on that replica only: the change is neither published to the replication servers nor recorded in the history of the entry. The control marks the whole request a synchronization operation, so schema and value-syntax checking, the pre-operation plugins - attribute uniqueness, referential integrity,modifiersNameandmodifyTimestamp- and password policy handling do not run for it either: a mistyped value is accepted without an error, and auserPasswordvalue is stored in the clear rather than encoded. The server honours the control only for a client that has thebypass-aclprivilege, or that an ACI allows to use it at the entry being repaired, and never on an add or a delete that also carries a proxied authorization control; otherwise it drops the control and processes the request as if the control had not been sent. Put nothing but the repair in the request, and send it as not critical. See "Repairing an Entry on One Replica" in the Administration Guide.
- Server-Side Sort request control
-
Object Identifier: 1.2.840.113556.1.4.473
- Server-Side Sort response control
-
Object Identifier: 1.2.840.113556.1.4.474
- Simple Paged Results Control
-
Object Identifier: 1.2.840.113556.1.4.319
- Subentries request controls
-
Object Identifier: 1.3.6.1.4.1.4203.1.10.1
Object Identifier: 1.3.6.1.4.1.7628.5.101.1
Internet-Draft: draft-ietf-ldup-subentry - LDAP Subentry Schema
- Subtree Delete request control
-
Object Identifier: 1.2.840.113556.1.4.805
Internet-Draft: draft-armijo-ldap-treedelete - Tree Delete Control
- Virtual List View request control
-
Object Identifier: 2.16.840.1.113730.3.4.9
- Virtual List View response control
-
Object Identifier: 2.16.840.1.113730.3.4.10
- The LDAP Relax Rules Control
-
Object Identifier: 1.3.6.1.4.1.4203.666.5.12
Internet-Draft: draft-zeilenga-ldap-relax-03 - The LDAP Relax Rules Control
Lets a client with the
bypass-aclprivilege add or modify attributes markedNO-USER-MODIFICATIONorOBSOLETE, and skips the schema check of the resulting entry. The values the client supplies forcreatorsName,createTimestamp,modifiersName,modifyTimestampandpwdChangedTimeare kept, and a pre-encoded password is accepted. The change is an ordinary one otherwise: it is logged, and it is replicated like any other.