RFC 3829

Lightweight Directory Access Protocol (LDAP) Authorization Identity Request and Response Controls

📅 published July 2004, from ietf

RFC 3829 🎀

Category: Informational 🧚 Date: July 2004 📅 Written by: Rob Weltman (America Online), Mark Smith (Pearl Crescent, LLC), and Mark Wahl 💖 Obsoletes / Updates: the header doesn't list any ✨

Title: Lightweight Directory Access Protocol (LDAP) Authorization Identity Request and Response Controls 💅

Status of This Memo ✨

Okay so this memo is just information for the Internet community 🌸 It is NOT an Internet standard of any kind, and it can be shared with anyone (distribution is unlimited) 🫶

Copyright Notice 🌈

Abstract 🦋

LDAP's bind operation gets a glow-up here 💖 This doc adds a way to ask for the authorization identity that a bind sets up, and to get it back in the response. Specifically, it defines the Authorization Identity Request and Response controls for use with the Bind operation ✨

1. Introduction 💜

This doc defines support for the Authorization Identity Request Control and the Authorization Identity Response Control, which let you ask for (and get back) the authorization set up in a bind operation 🎀 The request control may be sent by a client in a bind request if it's authenticating with version 3 of the Lightweight Directory Access Protocol (LDAP) protocol [LDAPv3]. Then, in the server's bind response, the server may include an Authorization Identity Response Control. That response control holds the identity the client ended up with 🔥

Why does this matter? Sometimes there's a mapping step or some other indirection during the bind, so the client needs a way to find out which LDAP identity it was actually granted 😭 Client authentication with certificates is the main situation where this shows up. Also, some Simple Authentication and Security Layer [SASL] mechanisms may not have the client explicitly give a DN, or they may end up with an authorization identity that's different from the authentication identity the client provided [AUTH] 🙈

The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT", and "MAY" used in this document are to be interpreted as described in [RFCKeyWords]. 🫶

2. Publishing support for the Authorization Identity Request Control and the Authorization Identity Response Control 🍓

Support for these two controls is advertised by having the Object Identifiers (OIDs) 2.16.840.1.113730.3.4.16 (request) and 2.16.840.1.113730.3.4.15 (response) show up in the supportedControl attribute [LDAPATTRS] of a server's root DSA-specific Entry (DSE). Respectively, so the request gets .16 and the response gets .15 ✨

3. Authorization Identity Request Control 🧚

This control MAY be included in any bind request that specifies protocol version 3. It goes in the controls field of the LDAPMessage, as defined in [LDAPPROT]. In a multi-step bind operation, the client MUST provide the control with each bind request. Non-negotiable 💅

controlType: 2.16.840.1.113730.3.4.16
controlValue: (absent)

The controlType is "2.16.840.1.113730.3.4.16", and the controlValue is absent 🦋

4. Authorization Identity Response Control 👑

This control MAY be included in any final bind response where the first bind request of the bind operation included an Authorization Identity Request Control in the controls field of the LDAPMessage, as defined in [LDAPPROT] 🌸

The controlType is "2.16.840.1.113730.3.4.15". If the bind request succeeded and resulted in an identity (not anonymous), the controlValue contains the authorization identity (authzId), as defined in [AUTH] section 9, that was granted to the requestor ✨ If the bind request resulted in an anonymous association, the controlValue field is a string of zero length 🙈 If the bind request resulted in more than one authzId, the primary authzId goes in the controlValue field 💖

The control is only included in a bind response if the resultCode for the bind operation is success 💅

If the server needs confidentiality protections in place before this control is used (see Security Considerations), the server reports that it doesn't have adequate confidentiality protections by returning the confidentialityRequired result code 🔒

If the client doesn't have enough access rights to the requested authorization information, the server says so by returning the insufficientAccessRights result code 😭

Identities a client presents during authentication can be mapped by the server to one or more authorization identities 🦋 The bind response control is how you retrieve the primary authzId 🫶

Here's an example 🎀 During client authentication with certificates [AUTH], a client might have more than one certificate and not be able to tell which one got picked for authentication to the server. The subject DN field in the selected certificate may not match a DN in the directory exactly, because it went through a mapping process that the server controls 🌈 After the certificate-based authentication, the client may send a SASL [SASL] bind request that specifies the EXTERNAL mechanism and includes an Authorization Identity Request Control. The bind response MAY include an Authorization Identity Response Control, showing the DN in the server's Directory Information Tree (DIT) that the certificate got mapped to 👑

5. Alternative Approach with Extended Operation 🧚

The LDAP "Who am I?" [AUTHZID] extended operation is a way to ask what authorization identity is tied to a bound connection 💜 Using an extended operation instead of a bind response control lets a client learn the authorization identity after the bind has set up integrity and data confidentiality protections 🔥 The downsides of the extended operation approach are coordination issues between "Who am I?" requests, bind requests, and other requests, plus the fact that you need an extra operation to learn the authorization identity 😭 For multithreaded or high bandwidth server application environments, the bind response approach may be preferable 🦋

6. Security Considerations 🔒

Okay, this part is serious, bestie 💀 The Authorization Identity Request and Response Controls are subject to standard LDAP security considerations. The controls may be passed over a secure channel as well as over an insecure one. They are NOT protected by security layers negotiated by the bind operation 🙈

The response control lets an additional authorization identity be passed along. In some deployments, these identities may contain confidential information that needs privacy protection. In those deployments, a security layer should be established before sending a bind request with an Authorization Identity Request Control 🛡️

7. IANA Considerations 🍓

The OIDs 2.16.840.1.113730.3.4.16 and 2.16.840.1.113730.3.4.15 are reserved for the Authorization Identity Request and Response Controls, respectively. The Authorization Identity Request Control has been registered as an LDAP Protocol Mechanism [IANALDAP] ✨

8. References 📚

8.1. Normative References

[LDAPv3]      Hodges, J. and R. Morgan, "Lightweight Directory Access
              Protocol (v3): Technical Specification", RFC 3377,
              September 2002.

[LDAPPROT]    Wahl, M., Howes, T. and S. Kille, "Lightweight
              Directory Access Protocol (v3)", RFC 2251, December
              1997.

[RFCKeyWords] Bradner, S., "Key Words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

[AUTH]        Wahl, M., Alvestrand, H., Hodges, J. and R. Morgan,
              "Authentication Methods for LDAP", RFC 2829, May 2000.

[SASL]        Myers, J., "Simple Authentication and Security Layer
              (SASL)", RFC 2222, October 1997.

[LDAPATTRS]   Wahl, M., Coulbeck, A., Howes, T. and S. Kille,
              "Lightweight Directory Access Protocol (v3): Attribute
              Syntax Definitions", RFC 2252, December 1997.

[IANALDAP]    Hodges, J. and R. Morgan, "Lightweight Directory Access
              Protocol (v3): Technical Specification", RFC 3377,
              September 2002.

8.2. Informative References 💜

[AUTHZID]     Zeilenga, K., "LDAP 'Who am I?' Operation", Work in
              Progress, April 2002.

9. Author's Addresses 🧚

Rob Weltman
America Online
360 W. Caribbean Drive
Sunnyvale, CA 94089
USA

Phone: +1 650 937-3194
EMail: robw@worldspot.com


Mark Smith
Pearl Crescent, LLC
447 Marlpool Drive
Saline, MI 48176
USA

Phone: +1 734 944-2856
EMail: mcs@pearlcrescent.com


Mark Wahl
PO Box 90626
Austin, TX 78709-0626
USA

10. Full Copyright Statement 🌈

Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🙈

Intellectual Property 🔥

The IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or on whether any license under such rights might or might not be available. It also doesn't claim to have made any independent effort to identify such rights. Info on the procedures for rights in RFC documents is in BCP 78 and BCP 79 📚

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt to get a general license or permission for implementers or users to use these proprietary rights can be obtained from the IETF's online IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 💌

Acknowledgement 🫶

Funding for the RFC Editor function is currently provided by the Internet Society 💖

📦 where this page comes from

ietf: rfc3829 2004-07
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms