RFC 1798
Connection-less Lightweight X.500 Directory Access Protocol
Connection-less Lightweight X.500 Directory Access Protocol 🎀
part 1 of 2 💅 more coming, bestie
- Network Working Group 🌐
- Request for Comments: 1798 💜
- Author: A. Young, ISODE Consortium 🫶
- Category: Standards Track ✨
- Date: June 1995 📅
- Obsoletes / Updates: the title block doesn't list anything this one obsoletes or updates 🙈
Status of this Memo
okay so this is an Internet standards track protocol for the Internet community 🌐, and it's literally asking everyone to chat about it and send suggestions for making it better 💬. for the standardization state and status of this protocol, check the current edition of "Internet Official Protocol Standards" (STD 1) 📚. and the best part? distribution of this memo is unlimited 🦋 so share it with everyone.
X.500
the whole point here is getting into the Directory without paying the resource tax of the Directory Access Protocol (DAP) [3] 💸. it skips the elapsed time that comes with connection-oriented communication, and it lets you use the Directory kinda like the DNS [5,6] 🧚. it's built for simple lookups where you just wanna read a few attribute values from one entry 🎀. it's meant to complement DAP and LDAP [4] 🫶, and the spec leans heavily on LDAP, so if you already know LDAP you're halfway there 💅.
1. Background ✨
the Directory can hold tons of different kinds of info 📇. but the full power of DAP is overkill for apps that only need simple read access to a few attribute values 🙄. application addressing is the perfect example: an application entity needs to figure out the Presentation Address (PA) of a peer entity when all it has is that peer's Application Entity Title (AET) 🔍. if the AET is a Directory Name (DN), the answer comes from the PA attribute of the Directory entry the AET identifies 🎯. it's giving DNS vibes, fr 💜.
doing that with DAP is a whole process 😩 and it takes a lot of network exchanges:
___________________________________________________________
|_#_|______Client_(DUA)________DAP________Server_(DSA)_____|
| 1| N-Connect.request -> |
| 2| <- N-Connect.response |
| 3| T-Connect.request -> |
| 4| <- T-Connect.response |
| | S-Connect.request, |
| | P-Connect.request, |
| | A-Associate.request, |
| 5| DAP-Bind.request -> |
| | S-Connect.response, |
| | P-Connect.response, |
| | A-Associate.response, |
| 6| <- DAP-Bind.response |
| 7| DAP-Read.request -> |
| 8| <- DAP-Read.response |
| | S-Release.request, |
| | P-Release.request, |
| | A-Release.request, |
| 9| DAP-Unbind.request -> |
| | S-Release.response, |
| | P-Release.response, |
| | A-Release.response, |
| 10| <- DAP-Unbind.response |
| | T-Disconnect.request, |
| 11| N-Disconnect.request -> |
| | T-Disconnect.response,|
| 12| <- N-Disconnect.response |
|___|______________________________________________________|that's 10 packets before the app can keep going, and it can probably keep going right after the T-Disconnect.request 🙃. the exact count can shift a bit depending on which Network and Transport service class you're using. like, TP4 over CLNS cuts the packet count by two ✂️.
LDAP isn't any better when the LDAP server has to use full DAP to talk to the Directory 😬:
____________________________________________________________________
|__#_|___Client_____LDAP_____LDAP_server______DAP_________DSA_______|
| 1 | TCP SYN -> |
| 2 | <- TCP SYN ACK |
| 3 | BindReq -> |
| 4 | N-Connect.req -> |
| 5 | <- N-Connect.res |
| 6 | T-Connect.req -> |
| 7 | <- T-Connect.res |
| 8 | DAP-Bind.req -> |
| 9 | <- DAP-Bind.res |
| 10 | <- BindRes |
| 11 | SearchReq -> |
| 12 | DAP-Search.req -> |
| 13 | <- DAP-Search.res |
| 14 | <- SearchRes |
| 15 | TCP FIN -> |
| 16 | DAP-Unbind.req -> |
| 17 | <- DAP-Unbind.res |
| 18 | N-Disconnect.req -> |
| 19 | <- N-Disconnect.res|
|____|______________________________________________________________|that's 14 packets before the app can continue 😵. even if the LDAP server lives on the same host as the DSA (so packet delay is basically nothing ✨), or the DSA speaks LDAP directly, you're still looking at 6 packets 💀:
____________________________________
| #| Client LDAP LDAP server|
|__|________________________________|
| 1| TCP SYN -> |
| 2| <- TCP SYN ACK|
| 3| BindReq -> |
| 4| <- BindRes |
| 5| SearchReq -> |
|_6|_______________<-____SearchRes__|so this protocol is for simple Directory access when those delays are just too much 😤 and you don't need the extra stuff that connection-mode operation brings 💖.
2. Protocol Model 🦋
CLDAP is based directly on LDAP [4] and inherits a bunch of the key LDAP vibes:
- many protocol data elements are encoded as ordinary strings (e.g., Distinguished Names) 🧵
- a lightweight BER encoding is used to encode all protocol elements 📦
it's different from LDAP in a couple of ways:
- protocol elements are carried directly over UDP or other connection-less transport, which skips a lot of the session/presentation overhead and the overhead of connections (LDAP uses a connection-mode transport service) 🚀
- a restricted set of operations is available 🤏
the definitions of most protocol elements are inherited from LDAP, so no need to reinvent the wheel 🛞.
the general model is clients doing protocol operations against servers. a client sends a protocol request describing the operation it wants to a server, and the server is responsible for doing the necessary operations on the Directory 🛠️. once that's done, the server sends back a response with any results or errors to the client that asked.
note that although servers are required to return responses whenever the protocol defines one, there's no requirement for synchronous behaviour on either the client or server side. requests and responses for multiple operations can be exchanged in any order, as long as servers eventually send a response for every request that requires one ⏳.
also, because the protocol runs over a connection-less transport service, clients must be prepared for requests or responses to get lost 📭. clients should use a retry mechanism with timeouts to get the reliability they want 🔁. for example, a client might send off a request and wait two seconds. no reply? it sends the request again and waits four seconds. still nothing? it sends it again and waits eight seconds, and so on, until some maximum time 🕰️. these algorithms are widely used in other datagram-based protocol implementations, like the DNS. the spec doesn't mandate one specific algorithm, because it depends on the requirements and operational environment of each CLDAP client implementation 🎯.
a client isn't required to abandon requests that got no response and no longer need one (because they timed out), but it may, if it wants 🙌.
and since servers are doing the work on behalf of clients, servers are expected to handle referrals themselves without sending them back to the client 🎁. this protocol has no provision for returning referrals to clients at all. the servers do all the necessary Directory work, and only final results or errors come back 💌.
this protocol can be mapped onto a strict subset of the Directory abstract service, so DAP can cleanly provide it 🧩.
3. Mapping Onto Transport Services 🌸
this protocol is designed to run over connection-less transports, and all 8 bits in an octet are significant in the data stream (no bit left behind 😤). two underlying services are specified here, though others are possible too 🦋.
3.1. User Datagram Protocol (UDP) 📮
CLDAPMessage PDUs map directly onto UDP datagrams 📦. only one request may be sent in a single datagram, and only one response may be sent in a single datagram, no stacking 🙅♀️. server implementations running over UDP should provide a protocol listener on port 389 🔊.
3.2. Connection-less Transport Service (CLTS) 🫧
each LDAPMessage PDU is mapped directly onto T-Unit-Data 🎯.
4. Elements of Protocol ✨
okay bestie, this is where we get into the actual message shapes 💅 CLDAP messages are defined by this ASN.1:
CLDAPMessage ::= SEQUENCE {
messageID MessageID,
user LDAPDN, -- on request only --
protocolOp CHOICE {
searchRequest SearchRequest,
searchResponse SEQUENCE OF
SearchResponse,
abandonRequest AbandonRequest
}
}where MessageID, LDAPDN, SearchRequest, SearchResponse and AbandonRequest are all defined in the LDAP protocol 🧚
so the whole thing is a SEQUENCE with a messageID, a user, and a protocolOp that's a CHOICE between a searchRequest, a searchResponse (which is a SEQUENCE OF SearchResponse, so it's literally a list 🥹), or an abandonRequest 🎀
the user element only shows up on requests 🙈 it should be zero length, and responses just ignore it. it can be used for logging purposes, but it's not required that a CLDAP server implementation apply any particular semantics to this field 🦋
Editorial note: there was some discussion about whether CLDAP requests should have authentication, and about the extra fields needed to support it. that could look like a clear text password (which would go against the current IAB drive to remove such things from protocols) or some arbitrary credentials. the field was NOT added. it was felt that authentication would generally add enough overhead to cancel out the benefits of CLDAP being connectionless. if an application needs authenticated access to the Directory, then CLDAP is not the right protocol for it 🙅♀️
ok so inside a searchResponse, every SearchResponse except the last one has the choice entry, and the last one has the choice resultCode ✨ there's also a little encoding optimisation: the objectName LDAP DN can use a trailing * to mean the baseObject of the matching searchRequest. so if the baseObject is "o=UofM, c=US", these are what the objectName values mean in a response 👑
objectName returned actual LDAPDN denoted
____________________________________________________
"*" "o=UofM, c=US"
"cn=Babs Jensen, *" "cn=Babs Jensen, o=UofM, c=US"4.1. Errors
the following error code gets added to the LDAPResult.resultCode enumeration of [4] 😭
resultsTooLarge (70),this error comes back when the LDAPMessage PDU holding the results of an operation is too big to be sent in a single datagram 🙈
4.2. Example
a simple lookup can be done in 4 packets 🍓 it drops to 2 if the DSA implements the CLDAP protocol, if the CLDAP server has a cache of the results you want, or if the CLDAP server and DSA are co-located so there's basically no delay between them 💜
_______________________________________________________________
|_#|___Client_____CLDAP____CLDAP_server____DAP________DSA______|
| 1| SearchReq -> |
| 2| DAP-Search.req -> |
| 3| <- DAP-Search.res|
| 4| <- SearchRes |
|__|___________________________________________________________|5. Implementation Considerations 🌈
the following subsections give guidance on implementing clients and servers that use the CLDAP protocol 🫶
5.1. Server Implementations
the whole goal of this protocol is to cut down the elapsed time between making a Directory request and getting the response, so a server that uses DAP to reach the directory should use techniques that help with that ⭐
- A server should remain bound to the Directory during reasonably long idle periods, or should remain bound permanently.
- Cacheing of results is highly desirable, but this has to be balanced against the need to provide up-to-date results, since DAP has no cache invalidation protocol (either implicit via timers or explicit) and no dontUseCopy service control in the protocol 🙈
of course, all of this is irrelevant if a DSA directly supports the CLDAP protocol 💅
5.2. Client Implementations
for simple lookup applications, using a retry algorithm with multiple servers, similar to what's commonly used in DNS stub resolver implementations, is recommended 🧚 the location of a CLDAP server (or servers) may be better specified using IP addresses (simple or broadcast) rather than names that first have to be looked up in another directory such as DNS 🦋
6. Security Considerations 💀
this is the serious part, bestie 🥺 this protocol provides no facilities for authentication. it is expected that servers will bind to the Directory either anonymously or using simple authentication without a password. no cap, that's a big deal, so plan around it 🔥
7. Bibliography 📚
[1] The Directory: Overview of Concepts, Models and Service. CCITT Recommendation X.500, 1988.
[2] The Directory: Models. CCITT Recommendation X.501 ISO/IEC JTC 1/SC21; International Standard 9594-2, 1988.
[3] The Directory: Abstract Service Definition. CCITT Recommendation X.511, ISO/IEC JTC 1/SC21; International Standard 9594-3, 1988.
[4] Yeong, W., Howes, T., and S. Kille, "X.500 Lightweight Directory Access Protocol", RFC 1487, Performance Systems International, University of Michigan, ISODE Consortium, July 1993.
[5] Mockapetris, P., "Domain Names - Implementation and Specification", STD 13, RFC 1035, USC/Information Sciences Institute, November 1987.
[6] Mockapetris, P., "Domain Names - Concepts and Facilities", STD 13, RFC 1034, USC/Information Sciences Institute, November 1987.
8. Acknowledgements 🫶
big thanks to Tim Howes and Steve Kille for their detailed comments, and to the other members of the working group 💖
this work was initiated by the Union Bank of Switzerland 🌸
9. Author's Address 🎀
Alan Young
ISODE Consortium
The Dome, The Square
RICHMOND
GB - TW9 1DT
Phone: +44 81 332 9091
EMail: A.Young@isode.com
X.400: i=A; s=Young; o=ISODE Consortium; p=ISODE; a=MAILNET; c=FI📦 where this page comes from
- ietf: rfc1798 1995-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms