RFC 3909

Lightweight Directory Access Protocol (LDAP) Cancel Operation

📅 published October 2004, from ietf

RFC 3909 🎀 The LDAP Cancel Operation

okay bestie, this one's the LDAP Cancel Operation 💖 It's an Standards Track spec from October 2004, written by Kurt D. Zeilenga of the OpenLDAP Foundation 🌸. It doesn't list anything it obsoletes or updates in its header, so it's standing on its own ✨.

Status of this Memo 📜

This doc is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶. For the current standardization state and status, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🦋.

Copyright Notice ©️

Abstract ✨

So this spec describes an LDAP extended operation that lets you cancel (or abandon) an outstanding operation 🧚. The vibe is that, unlike the LDAP Abandon operation, but like the X.511 Directory Access Protocol (DAP) Abandon operation, this one actually sends back a response telling you how it went 👑.

1. Background and Intent of Use 🍓

Okay, so LDAP [RFC3377] has an Abandon operation [RFC2251] that clients can use to cancel other operations 💅. The problem is Abandon doesn't send a response, and the abandoned operation doesn't need to respond either 😭. So the client basically gets zero clear info about whether the abandon actually worked 💀.

X.511 DAP [X.511] has an Abandon operation that does get a response, and it also requires the abandoned operation to return a response saying it was canceled 🔥. The LDAP Cancel operation is modeled after that DAP one, so it's giving main character energy 🦋.

The LDAP Cancel operation SHOULD be used instead of the LDAP Abandon operation when the client needs an indication of the outcome ✨. It can cancel both interrogation and update operations 🌈.

Protocol elements are described using ASN.1 [X.680] with implicit tags 🧚. "BER-encoded" just means the element gets encoded using the Basic Encoding Rules [X.690], under the restrictions in Section 5.1 of [RFC2251] 🎀.

Quick glossary: DSA stands for Directory System Agent (or server), and DSE stands for DSA-specific Entry 🫶.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] 🔥.

2. Cancel Operation 💖

The Cancel operation is an LDAP Extended Operation [RFC2251, Section 4.12] identified by the object identifier 1.3.6.1.1.8 🌸. This section covers the syntax of the Cancel request and response messages, and it defines extra LDAP resultCodes 💅.

2.1. Cancel Request 🦋

The Cancel request is an ExtendedRequest where the requestName field holds 1.3.6.1.1.8, and the requestValue field holds a BER-encoded cancelRequestValue ✨.

cancelRequestValue ::= SEQUENCE {
    cancelID        MessageID
                    -- MessageID is as defined in [RFC2251]
}

The cancelID field holds the message ID of the operation you want canceled 🍓.

2.2. Cancel Response 🌈

A Cancel response is an ExtendedResponse where the responseName and response fields are absent 🧚.

2.3. Additional Result Codes 🔥

Implementations of this specification SHALL recognize the following additional resultCode values 👑:

canceled        (118)
noSuchOperation (119)
tooLate         (120)
cannotCancel    (121)

3. Operational Semantics 💅

The whole point of the Cancel Operation is to ask the server to cancel an outstanding operation that was issued within the same session 🫶.

The client asks for cancelation by issuing a Cancel Response with a cancelID set to the message ID of the outstanding operation 🎀. The Cancel Request itself has its own distinct message ID ✨. Clients SHOULD NOT request the cancelation of the same operation multiple times 😭.

If the server is willing and able to cancel the outstanding operation identified by the cancelId, the server SHALL return a Cancel Response with a success resultCode, and the canceled operation SHALL fail with the canceled resultCode 🔥. Otherwise, the Cancel Response SHALL have a non-success resultCode and SHALL NOT have an impact upon the outstanding operation (if it exists) 💀.

The protocolError resultCode gets returned if the server can't parse the requestValue, or if the requestValue is absent, 🙈

The noSuchOperation resultCode gets returned if the server has no knowledge of the operation requested for cancelation 🧚.

The cannotCancel resultCode gets returned if the identified operation doesn't support cancelation, or if the cancel operation couldn't be performed. These classes of operations are NOT cancelable 🦋:

operations which have no response,
operations which create, alter, or destroy authentication and/or authorization associations,
operations which establish, alter, or tear-down security services, and
operations which abandon or cancel other operations.

Specifically, the Abandon, Bind, Start TLS [RFC2830], Unbind, and Cancel operations are not cancelable 💜.

The Cancel operation cannot be abandoned. 🙅‍♀️

The tooLate resultCode gets returned to say it's too late to cancel the outstanding operation 🍓. For example, the server may return tooLate for a request to cancel an outstanding modify operation that has already committed updates to the underlying data store 😬.

Servers SHOULD indicate their support for this extended operation by providing 1.3.6.1.1.8 as a value of the 'supportedExtension' attribute type in their root DSE 🌈. A server MAY choose to advertise this extension only when the client is authorized to use it 🔐.

4. Security Considerations 🔐

This one is serious, bestie, so read closely 💀

This operation is meant to let a user cancel operations they previously issued during the current LDAP association 🫶. In certain cases, like when the Proxy Authorization Control is in use, different outstanding operations may be processed under different LDAP associations 🌸. Servers MUST NOT allow a user to cancel an operation belonging to another user 🚫.

Some operations should not be cancelable for security reasons ✨. This spec disallows canceling the Bind operation and the Start TLS extended operation, so that authentication, authorization, and security layer semantics don't get more complicated 🧚. Designers of future extended operations and/or controls should disallow abandonment and cancelation when appropriate 👑.

5. IANA Considerations 🌷

The following values [RFC3383] have been registered by the IANA 💅.

5.1. Object Identifier 🎀

The IANA has registered the LDAP Object Identifier 1.3.6.1.1.8 upon Standards Action, to identify the LDAP Cancel Operation as defined in this document 🦋.

Subject: Request for LDAP Object Identifier Registration
Person & email address to contact for further information:
     Kurt Zeilenga <kurt@OpenLDAP.org>
Specification: RFC 3909
Author/Change Controller: IESG
Comments:
     Identifies the LDAP Cancel Operation

5.2. LDAP Protocol Mechanism 🧚

The IANA has registered the LDAP Protocol Mechanism described in this document upon Standards Action ✨.

Subject: LDAP Protocol Mechanism Registration
Object Identifier: 1.3.6.1.1.8
Description: LDAP Cancel Operation
Person & email address to contact for further information:
     Kurt Zeilenga <kurt@openldap.org>
Usage: Extended Operation
Specification: RFC 3909
Author/Change Controller: IESG
Comments: none

5.3. LDAP Result Codes 🍓

The IANA has registered the LDAP Result Codes described in this document upon Standards Action 🌈.

Subject: LDAP Result Code Registration
Person & email address to contact for further information:
     Kurt Zeilenga <kurt@OpenLDAP.org>
Result Code Name: canceled (118)
Result Code Name: noSuchOperation (119)
Result Code Name: tooLate (120)
Result Code Name: cannotCancel (121)
Specification: RFC 3909
Author/Change Controller: IESG

6. Acknowledgment 💖

The LDAP Cancel operation is modeled after the X.511 DAP Abandon operation 🫶.

7. References 📚

7.1. Normative References 🔥

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2251]  Wahl, M., Howes, T., and S. Kille, "Lightweight Directory
           Access Protocol (v3)", RFC 2251, December 1997.

[RFC2830]  Hodges, J., Morgan, R., and M. Wahl, "Lightweight
           Directory Access Protocol (v3): Extension for Transport
           Layer Security", RFC 2830, May 2000.

[RFC3377]  Hodges, J. and R. Morgan, "Lightweight Directory Access
           Protocol (v3): Technical Specification", RFC 3377,
           September 2002.

[X.680]    International Telecommunication Union - Telecommunication
           Standardization Sector, "Abstract Syntax Notation One
           (ASN.1) - Specification of Basic Notation", X.680(1997)
           (also ISO/IEC 8824-1:1998).

[X.690]    International Telecommunication Union - Telecommunication
           Standardization Sector, "Specification of ASN.1 encoding
           rules: Basic Encoding Rules (BER), Canonical Encoding
           Rules (CER), and Distinguished Encoding Rules (DER)",
           X.690(1997) (also ISO/IEC 8825-1:1998).

7.2. Informative References 🌸

[RFC3383]  Zeilenga, K., "Internet Assigned Numbers Authority (IANA)
           Considerations for the Lightweight Directory Access
           Protocol (LDAP)", BCP 64, RFC 3383, September 2002.

[X.511]    International Telecommunication Union - Telecommunication
           Standardization Sector, "The Directory: Abstract Service
           Definition", X.511(1993).

8. Author's Address 🧚

Kurt D. Zeilenga
OpenLDAP Foundation

EMail: Kurt@OpenLDAP.org

This document is subject to the rights, licenses and restrictions contained in BCP 78, and at www.rfc-editor.org, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property ✨

okay so the IETF is NOT picking a side here 🙈 It takes no position on whether any Intellectual Property Rights or other rights that someone might claim over the tech in this document are valid or in scope. It also doesn't say whether any license under those rights might or might not be available, and it doesn't claim to have done any independent digging to find such rights. If you want the ISOC rules for rights in ISOC Documents, check BCP 78 and BCP 79 💅

Copies of IPR disclosures sent to the IETF Secretariat are a thing, and so are any assurances of licenses that might be offered. You can also find the results of anyone trying to get a general license or permission to use those proprietary rights for implementers or users of this specification in the IETF on-line IPR repository at http://www.ietf.org/ipr 📚

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 💌

Acknowledgement

funding for the RFC Editor function is currently provided by the Internet Society 🫶🌈

📦 where this page comes from

ietf: rfc3909 2004-10
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms