RFC 3045

Storing Vendor Information in the LDAP root DSE 💖

Okay bestie, this is RFC 3045 🎀. It's written by Mark Meredith of Novell Inc. 💅 It's Informational (so it's giving "here's some useful info," not a standard 🌸), dated January 2001 ✨. The title block doesn't list any RFC that it obsoletes or updates, so it's not replacing or patching anything 🧚.

---

Status of This Memo ✨

This memo gives info to the Internet community 🦋. It is NOT a standard of any kind, and you can pass it around as much as you like 💜.

Copyright Notice 🌈

Copyright (C) The Internet Society (2001). All Rights Reserved.

Abstract 🎀

Okay so this doc defines two LDAP attributes, vendorName and vendorVersion 💅. A server MAY include them in the root DSA-specific Entry (DSE) to show off vendor-specific info ✨. They basically add onto the attributes already in section 3.4 of RFC 2251 🫶.

The info in these attributes MAY be used for display and informational purposes 🌸, but it MUST NOT be used for feature advertisement or discovery 🙈. Not me using vendor names to guess what a server can do, periodt 💀.

Conventions used in this document 🍓

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2219]

1. Overview 🦋

LDAP clients find out server stuff like available controls, extensions, and so on by reading the root DSE 🔥. Check section 3.4 of [RFC2251] for the full tea ☕.

For display, info, and limited function discovery, it's desirable to ask an LDAP server for the vendor name and also which version of that vendor's code is installed 💖.

1.1 Function discovery ⭐

There are so many ways a vendor's LDAP server can be functionally incomplete or have software anomalies 💀. It's impossible to list every known shortcoming with just this set of server data attributes 😭. And honestly, anomalies often don't get found until after the implementation has shipped, been deployed, and is in use 🙈.

Client implementations MAY use the attributes defined in this document to identify a particular server implementation so they can "work around" those anomalies 🧚.

The attributes defined in this document MUST NOT be used to gather info about supported features of an LDAP implementation 🚫. All LDAP features, mechanisms, and capabilities, if they're advertised, MUST be advertised through other mechanisms 💅. Preferably, use the advertisement mechanisms that were defined alongside those features, mechanisms, and capabilities 👑.

2. Attribute Types 💜

These attributes are an addition to the Server-specific Data Requirements in section 3.4 of [RFC2251] 🎀. Their syntaxes are defined in section 4 of [RFC2252] ✨.

Servers MAY restrict access to vendorName or vendorVersion, and clients MUST NOT expect these attributes to be available 🙈. Not everyone gets to see the tea 🍵.

2.1 vendorName 🌸

This attribute holds one string, which is the name of the LDAP server implementer 💖.

All LDAP server implementations SHOULD maintain a vendorName 🫶. It's usually the name of the company that wrote the LDAP server code, like "Novell, Inc." 🏢

   ( 1.3.6.1.1.4 NAME 'vendorName' EQUALITY
     1.3.6.1.4.1.1466.109.114.1 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )

2.2 vendorVersion 🔥

This attribute holds a string that says which version of the LDAP server implementation it is 🧚. It's usually a release value, made of a string and/or a string of numbers, that the product's developer uses 💅. (That's different from supportedLDAPVersion, which tells you which version of the LDAP protocol the server supports 👑.) It's single-valued, so there's only one version value at a time ✨.

All LDAP server implementations SHOULD maintain a vendorVersion 💖. This string MUST be unique between two versions 🔐, but there are no other syntax rules on the value or how it's formatted 🦋. Anything goes, bestie 🌈.

   ( 1.3.6.1.1.5 NAME 'vendorVersion' EQUALITY
     1.3.6.1.4.1.1466.109.114.1 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )

Okay, why does vendorVersion use an equality match and not a less-than or greater-than one? 🤔 Picture this: release "LDAPv3 8.0" has a bug that gets fixed in "LDAPv3 8.5" 😭. But there's also an update called "LDAPv3 8.01" that fixes the bug too 🩹. Without the equality match, a client might say it won't work with anything less than "LDAPv3 8.5," even though "LDAPv3 8.01" would work just fine 💀. With equality, the client has to match exactly what it's looking for, so it doesn't accidentally skip the working version 💅.

3. Notes to Server Implementers 🧚

Server implementers might want to tie the vendorVersion value to the build mechanism 🛠️. That way it updates automatically whenever the version changes ✨.

4. Notes to Client Developers 💅

Like we said in section 2.1, vendorName and vendorVersion MUST NOT be used to discover features 🚫. Don't go there, bestie 🙅‍♀️.

It's worth noting that an anomaly often only affects a subset of the implementations that report the same version info 🙈. Most implementations run on multiple platforms, have loads of configuration options, and often support plug-ins 🔌. So the same version number can behave differently depending on how it's set up 🌸.

Client implementations SHOULD be written to accept any value in the vendorName and vendorVersion attributes 🫶. If a client doesn't recognize a specific vendorName or vendorVersion, then for "working around" anomalies, the client MUST assume the server is complete and correct 👑. The client MUST also work with implementations that don't publish these attributes at all 💖. Everyone's invited to the party 🎉.

5. Security Considerations 🔐

Okay, serious moment, I promise 🥺. The vendorName and vendorVersion attributes are only meant for display, informational use, or identifying anomalies 🛡️. Client and application implementers have to keep in mind that just because a vendorName or vendorVersion value is there doesn't guarantee the server was actually built by that vendor, or that its version really is the one it claims 😱. They should act accordingly 🫡.

Server implementers should know that this info could be used to exploit a security hole the server has, whether it's a feature or a flaw 💀. Be careful about what you're broadcasting, bestie 🚨.

6. IANA Considerations 🌸

This document wants to create two attributes, vendorName and vendorVersion, that IANA will mainly be in charge of 🧚. It's a one-time thing, so there's no need for any recurring assignments after this stage ✨.

7. References 📚

[RFC2219]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2026]  Bradner, S., "The Internet Standards Process -- Revision
           3", BCP 9, RFC 2026, October 1996.

[RFC2251]  Wahl, M., Howes, T. and S. Kille, "Lightweight Directory
           Access Protocol (v3)", RFC 2251, December 1997.

[RFC2252]  Wahl, M., Coulbeck, A., Howes, T. and S. Kille,
           "Lightweight Directory Access Protocol (v3): Attribute
           Syntax Definitions", RFC 2252, December 1997.

8. Acknowledgments 🫶

The author would like to thank the generous input and review from folks at Novell, including but not limited to Jim Sermersheim, Mark Hinckley, Renea Campbell, and Roger Harrison 💜. Also a big shoutout to IETF contributors Kurt Zeilenga, Mark Smith, Mark Wahl, Peter Strong, Thomas Salter, Gordon Good, Paul Leach, and Helmut Volpers 👑✨.

9. Author's Address 📮

Mark Meredith Novell Inc. 1800 S. Novell Place Provo, UT 84606

Phone: 801-861-2645 EMail: mark_meredith@novell.com

10. Full Copyright Statement 🌈

Copyright (C) The Internet Society (2001). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 💅

Funding for the RFC Editor function is currently provided by the Internet Society 🌸✨.