RFC 3494

RFC 3494: Lightweight Directory Access Protocol version 2 (LDAPv2) to Historic Status 💖

Okay bestie, here's the deal 🫶 This is an informational doc from the Network Working Group by K. Zeilenga (Kurt D. Zeilenga) at the OpenLDAP Foundation, dated March 2003. Its category is Informational, and it obsoletes RFC 1484, 1485, 1487, 1488, 1777, 1778, 1779, 1781, and 2559. It's basically a "time to retire LDAPv2" memo 🌸

---

Status of this Memo ✨

This memo gives info to the Internet community. It's not an Internet standard of any kind 🙈 Distribution of this memo is unlimited 🦋

Copyright Notice 💜

Copyright (C) The Internet Society (2003). All Rights Reserved. 🌈

Abstract 🍓

So this doc recommends retiring version 2 of the Lightweight Directory Access Protocol (LDAPv2) along with other dependent specs, and it explains why 💅 It recommends that RFC 1777, 1778, 1779, 1781, and 2559 (plus the docs they superseded) get moved to Historic status.

Lightweight Directory Access Protocol, version 2 🎀

Okay so LDAPv2 is an Internet protocol used to access X.500-based directory services ✨ [RFC1777][RFC1778][RFC1779]. This doc recommends that LDAPv2 and its dependent specs be retired, and specifically that RFC 1777, 1778, 1779, 1781, and 2559 (plus the docs they superseded) be moved to Historic status. The reasons are coming up, don't worry 💖

LDAPv2 was published in 1995 as a Draft Standard. Since then, people found a bunch of inadequacies in the spec 😭 So LDAPv3 [RFC3377] came out in 1997 as a Proposed Standard to fix them. LDAPv3 is currently being revised [LDAPbis], but it's clearly technically superior to LDAPv2 👑

Here's the tea ☕ LDAPv2 isn't really followed. An independently developed implementation of the spec wouldn't interoperate with existing ones, because existing implementations use different syntaxes and semantics than the spec prescribes. Two examples:

1. Existing LDAPv2 implementations don't commonly restrict textual values to IA5 (ASCII) and T.61 (Teletex) like RFC 1777 and RFC 1778 require. Some use ISO 8859-1, some use UCS-2, some use UTF-8, and some use the current local character set. Chaos 💀
2. RFC 1777 requires using the textual string associated with AttributeType in the X.500 Directory standards. But existing implementations use the NAME associated with the AttributeType in the LDAPv3 schema [RFC2252]. So in LDAPv2, the organization name attribute has to be named "organizationName", not "o" 🙄

And security? Not it 🥺 LDAPv2 doesn't give any mechanism for data integrity or confidentiality, and it doesn't support modern auth mechanisms like the ones based on DIGEST-MD5, Kerberos V, and X.509 public keys.

Dependent Specifications 🦋

Since RFC 1777, 1778, and 1779 came out, a few more standard track RFCs have shown up that depend on them, including:

"Using the OSI Directory to Achieve User Friendly Naming" [RFC1781]

and

"Internet X.509 Public Key Infrastructure Operational Protocols - LDAPv2" [RFC2559].

RFC 1781 is a technical spec for "User Friendly Naming" that relies on particular syntaxes described in RFC 1779. RFC 2253, which replaced RFC 1779, dropped support for the "User Friendly Naming" syntaxes 💅 RFC 1781 is currently a Proposed Standard.

RFC 2559 is mainly an applicability statement for using LDAPv2 to provide Public Key Infrastructure. It depends on RFC 1777 and updates RFC 1778. If LDAPv2 gets moved to Historic status, so must this document 🫶 RFC 2559 is currently a Proposed Standard.

Security Considerations 🔥

LDAPv2 does not provide adequate security mechanisms for general use on the Internet. LDAPv3 offers far superior security mechanisms, including support for strong authentication and data confidentiality services. Moving LDAPv2 to Historic may improve the security of the Internet by encouraging implementation and use of LDAPv3. 😭🔥

Recommendations 👑

Developers should not implement LDAPv2 per RFC 1777, because that would result in an implementation that won't interoperate with existing LDAPv2 implementations. Developers should implement LDAPv3 instead 💖

Deployers should recognize that significant interoperability issues exist between current LDAPv2 implementations. LDAPv3 is clearly technically superior to LDAPv2, so it should be used instead ✨

It is recommended that RFC 1777, RFC 1778, RFC 1779, RFC 1781, and RFC 2559 be moved to Historic status 🌸

The previously superseded specs RFC 1484, 1485, 1487, and 1488 (superseded by RFC 1781, 1779, 1777, and 1778, respectively) should also be moved to Historic status 🧚

Acknowledgment 🫶

The author would like to thank the designers of LDAPv2 for their contribution to the Internet community. Respect 🌈

Normative References 📚

• [RFC1777] Yeong, W., Howes, T. and S. Kille, "Lightweight Directory Access Protocol", RFC 1777, March 1995.
• [RFC1778] Howes, T., Kille, S., Yeong, W. and C. Robbins, "The String Representation of Standard Attribute Syntaxes", RFC 1778, March 1995.
• [RFC1779] Kille, S., "A String Representation of Distinguished Names", RFC 1779, March 1995.
• [RFC1781] Kille, S., "Using the OSI Directory to Achieve User Friendly Naming", RFC 1781, March 1995.
• [RFC2559] Boeyen, S., Howes, T. and P. Richard, "Internet X.509 Public Key Infrastructure Operational Protocols - LDAPv2", RFC 2559, April 1999.

Informative References 🧚

• [LDAPbis] IETF LDAP Revision (v3) Working Group (LDAPbis), <http://www.ietf.org/html-charters/ldapbis-charter.html>.
• [RFC3377] Hodges, J. and R. Morgan, "Lightweight Directory Access Protocol (v3): Technical Specification", RFC 3377, September 2002.
• [RFC2252] Wahl, M., Coulbeck, A., Howes, T. and S. Kille, "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997.
• [RFC2253] Wahl, M., Kille, S. and T. Howes, "Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names", RFC 2253, December 1997.

Author's Address 🎀

Kurt D. Zeilenga OpenLDAP Foundation

EMail: Kurt@OpenLDAP.org

Full Copyright Statement 🌈

Copyright (C) The Internet Society (2003). All Rights Reserved.

You can copy and share this document and its translations, and you can make, copy, publish, and distribute derivative works that comment on or explain it, or help with implementing it, in whole or in part, with no restrictions, as long as the above copyright notice and this paragraph are included on all copies and derivative works. But this document itself can't be modified in any way, like removing the copyright notice or the references to the Internet Society or other Internet organizations. The exceptions are when it's needed to develop Internet standards, in which case the copyright procedures in the Internet Standards process must be followed, or when it's translated into languages other than English. 🦋

The permissions above are perpetual and won't be revoked by the Internet Society or its successors or assigns 💜

This document and the information in it are provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 💅

Funding for the RFC Editor function is currently provided by the Internet Society ✨