RFC 4521
Considerations for Lightweight Directory Access Protocol (LDAP) Extensions
RFC 4521: Considerations for Lightweight Directory Access Protocol (LDAP) Extensions 🎀
okay bestie, let's get into RFC 4521 💅 It was written by K. Zeilenga from the OpenLDAP Foundation, and it was published in June 2006 under the Network Working Group. It's a Best Current Practice, which the document calls BCP 118 🧚 Its category is Best Current Practice, and its title block doesn't list anything it obsoletes or updates. It's basically a guide for anyone designing new stuff for LDAP.
Status of This Memo ✨
This document specifies an Internet Best Current Practices for the Internet Community, and it asks for discussion and suggestions for improvements. Distribution of this memo is unlimited.
Copyright Notice 🌸
Copyright (C) The Internet Society (2006).
Abstract 🦋
LDAP is extensible, and I'm obsessed. 😭 It gives you ways to add brand-new operations, extend operations that already exist, and expand both user and system schemas. This doc talks about the considerations that designers of LDAP extensions should keep in mind.
Table of Contents 📑
1. Introduction ....................................................3
1.1. Terminology ................................................3
2. General Considerations ..........................................4
2.1. Scope of Extension .........................................4
2.2. Interaction between extensions .............................4
2.3. Discovery Mechanism ........................................4
2.4. Internationalization Considerations ........................5
2.5. Use of the Basic Encoding Rules ............................5
2.6. Use of Formal Languages ....................................5
2.7. Examples ...................................................5
2.8. Registration of Protocol Values ............................5
3. LDAP Operation Extensions .......................................6
3.1. Controls ...................................................6
3.1.1. Extending Bind Operation with Controls ..............6
3.1.2. Extending the Start TLS Operation with Controls .....7
3.1.3. Extending the Search Operation with Controls ........7
3.1.4. Extending the Update Operations with Controls .......8
3.1.5. Extending the Responseless Operations with Controls..8
3.2. Extended Operations ........................................8
3.3. Intermediate Responses .....................................8
3.4. Unsolicited Notifications ..................................9
4. Extending the LDAP ASN.1 Definition .............................9
4.1. Result Codes ...............................................9
4.2. LDAP Message Types .........................................9
4.3. Authentication Methods ....................................10
4.4. General ASN.1 Extensibility ...............................10
5. Schema Extensions ..............................................10
5.1. LDAP Syntaxes .............................................11
5.2. Matching Rules ............................................11
5.3. Attribute Types ...........................................12
5.4. Object Classes ............................................12
6. Other Extension Mechanisms .....................................12
6.1. Attribute Description Options .............................12
6.2. Authorization Identities ..................................12
6.3. LDAP URL Extensions .......................................12
7. Security Considerations ........................................12
8. Acknowledgements ...............................................13
9. References .....................................................13
9.1. Normative References ......................................13
9.2. Informative References ....................................151. Introduction ✨
LDAP (the Lightweight Directory Access Protocol) [RFC4510] is an extensible protocol, so it's built to grow. 🌈
LDAP lets new operations be added, and it lets existing operations be enhanced [RFC4511].
LDAP lets extra schema be defined [RFC4512][RFC4517]. That can mean additional object classes, attribute types, matching rules, extra syntaxes, and other schema elements. LDAP also gives attribute types a way to be extended with options [RFC4512].
LDAP supports a Simple Authentication and Security Layer (SASL) authentication method [RFC4511][RFC4513]. SASL [RFC4422] is extensible too. LDAP may be extended to support additional authentication methods [RFC4511].
LDAP supports establishing Transport Layer Security (TLS) [RFC4511][RFC4513]. TLS [RFC4346] is extensible as well.
LDAP has an extensible Uniform Resource Locator (URL) format [RFC4516]. 🔗
Last but not least, LDAP allows certain extensions to the protocol's Abstract Syntax Notation - One (ASN.1) [X.680] definition. This opens the door to a wide range of protocol enhancements. For example, new result codes that an extension needs can be added by extending the protocol's ASN.1 definition 💖
This document describes practices that engineers should consider when designing extensions to LDAP.
1.1. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119]. In this document, "the specification", as used by BCP 14, RFC 2119, refers to the engineering of LDAP extensions.
The term "Request Control" refers to a control attached to a client-generated message sent to a server. The term "Response Control" refers to a control attached to a server-generated message sent to a client.
Quick abbreviation check, because the acronyms are everywhere 🙈
- DIT stands for Directory Information Tree.
- DSA stands for Directory System Agent, a server.
- DSE stands for DSA-Specific Entry.
- DUA stands for Directory User Agent, a client.
- DN stands for Distinguished Name.
2. General Considerations 🎀
2.1. Scope of Extension 💅
Mutually agreeing peers may, within the confines of an extension, agree to significant changes in protocol semantics. However, designers MUST consider the impact of an extension upon protocol peers that have not agreed to implement or otherwise recognize and support the extension. Extensions MUST be "truly optional" [RFC2119]. No cap, this part is serious.
2.2. Interaction between extensions 🦋
Designers SHOULD consider how the extensions they engineer interact with other extensions.
Designers SHOULD consider the extensibility of the extensions they specify. Extensions to LDAP SHOULD themselves be extensible. 🧚
Except where it is stated otherwise, extensibility is implied.
2.3. Discovery Mechanism 🔍
Extensions SHOULD provide adequate discovery mechanisms.
LDAP is built on the client-request/server-response paradigm, so the general discovery approach is for the client to discover the capabilities of the server before it uses a particular extension. Commonly, this discovery means querying the root DSE and/or other DSEs for operational information associated with the extension. LDAP provides no mechanism for a server to discover the capabilities of a client. Not me being like "wait, the server can't check the client?" 😭
The 'supportedControl' attribute [RFC4512] is used to advertise supported controls. The 'supportedExtension' attribute [RFC4512] is used to advertise supported extended operations. The 'supportedFeatures' attribute [RFC4512] is used to advertise features. Other root DSE attributes MAY be defined to advertise other capabilities.
2.4. Internationalization Considerations 🌍
LDAP is designed to support the full Unicode [Unicode] repertory of characters. Extensions SHOULD avoid unnecessarily restricting applications to subsets of Unicode (e.g., Basic Multilingual Plane, ISO 8859-1, ASCII, Printable String). Restricting people to a tiny set of characters is giving not inclusive 🙅♀️
LDAP Language Tag options [RFC3866] provide a mechanism for tagging text (and other) values with language information. Extensions that define attribute types SHOULD allow use of language tags with these attributes. 🌸
2.5. Use of the Basic Encoding Rules 🔢
Numerous elements of LDAP are described using ASN.1 [X.680] and are encoded using a particular subset [Protocol, Section 5.2] of the Basic Encoding Rules (BER) [X.690]. To allow reuse of the parsers and generators used to implement the LDAP "core" technical specification [RFC4510], it is RECOMMENDED that extension elements (e.g., extension-specific contents of controlValue, requestValue, and responseValue fields) described by ASN.1 and encoded using BER be subjected to the restrictions of [Protocol, Section 5.2]. Reuse is the whole vibe ✨
2.6. Use of Formal Languages 📐
Formal languages SHOULD be used in specifications in accordance with IESG guidelines [FORMAL].
2.7. Examples 🍓
Example DN strings SHOULD conform to the syntax defined in [RFC4518]. Example LDAP filter strings SHOULD conform to the syntax defined in [RFC4515]. Example LDAP URLs SHOULD conform to the syntax defined in [RFC4516]. Entries SHOULD be represented using LDIF [RFC2849].
2.8. Registration of Protocol Values 🗂️
Designers SHALL register protocol values of their LDAP extensions in accordance with BCP 64, RFC 4520 [RFC4520]. Specifications that create new extensible protocol elements SHALL extend existing registries or establish new registries for values of these elements in accordance with BCP 64, RFC 4520 [RFC4520] and BCP 26, RFC 2434 [RFC2434]. Registries are where your protocol values get their main character moment 👑
3. LDAP Operation Extensions 🧚
Extensions SHOULD use controls when defining extensions that complement existing operations. Where the extension to be defined does not complement an existing operation, designers SHOULD consider defining an extended operation instead.
For example, a subtree delete operation could be designed either as an extension of the delete operation or as a new operation. As the feature complements the existing delete operation, using the control mechanism to extend the delete operation is likely more appropriate. ✨
As a counter (and contrived) example, a locate services operation (an operation that would return, for a DN, a set of LDAP URLs to services that may hold the entry named by this DN) could be designed either as a search operation or as a new operation. As the feature doesn't complement the search operation (e.g., the operation is not contrived to search for entries held in the Directory Information Tree), it is likely more appropriate to define a new operation using the extended operation mechanism. Not every idea belongs in search, bestie 🙈
3.1. Controls 🎛️
Controls [Protocol, Section 4.1.11] are the RECOMMENDED mechanism for extending existing operations. The existing operation can be a base operation defined in [RFC4511] (e.g., search, modify), an extended operation (e.g., Start TLS [RFC4511], Password Modify [RFC3062]), or an operation defined as an extension to a base or extended operation.
Extensions SHOULD NOT return Response controls unless the server has specific knowledge that the client can make use of the control. Generally, the client requests the return of a particular Response Control by providing a related Request Control. 🎀
An existing operation MAY be extended to return IntermediateResponse messages [Protocol, Section 4.13].
Specifications of controls SHALL NOT attach additional semantics to the criticality of controls beyond those defined in [Protocol, Section 4.1.11]. A specification MAY mandate that the criticality take on a particular value (e.g., TRUE or FALSE), where appropriate. That's the end of this part, but the story continues. 💜
3.1.1. Extending Bind Operation with Controls ✨
okay so controls riding along on a Bind request and response (the [RFC4511] kind) are not protected by whatever security layers that Bind sets up 😭 bestie that's the tea 🫖
so anyone writing a control extension for Bind SHALL say clearly that the Bind negotiated security layers don't protect the info in those controls. they also SHALL explain how that info is protected, or why it doesn't need protection 🔐
it is RECOMMENDED that designers look at other options first 💅 for example, you could send an extended operation after the Bind (which means the security layers from Bind DO cover it) and get the same result 🦋
also, designers of Bind control extensions MUST think about how the control's meaning interacts with each step of a multi-step Bind 🧚 some steps are optional, so those need extra attention. not me overlooking that 🙈
3.1.2. Extending the Start TLS Operation with Controls
same energy but for Start TLS 🌸 controls on the request and response of a Start TLS Operation [RFC4511] are not protected by the security layers that the Start TLS operation sets up 🥲
specs for controls that extend Start TLS SHALL say that the Start TLS negotiated security layers don't protect the info in those controls, and SHALL spell out how that info is protected or why it doesn't need protection 💜
it is RECOMMENDED that designers think about other mechanisms too ✨ for example, an extended operation sent after Start TLS (so it's protected by the layers Start TLS negotiated) can deliver the same function 🎀
3.1.3. Extending the Search Operation with Controls
ok the Search operation has two phases, and it's giving very organised 🗂️
- finding the base object; and
- searching for objects at or under that base object.
so if you're writing a control for Search, you should clearly say which phase(s) its semantics apply to 💖 and if the control isn't specific to Search, its semantics SHOULD apply in the finding phase 🍓
3.1.4. Extending the Update Operations with Controls
update operations are giving ACID energy 🧪 they have atomicity, consistency, isolation, and durability ([ACID]):
- atomicity: All or none of the DIT changes requested are made.
- consistency: The resulting DIT state must be conform to schema and other constraints.
- isolation: Intermediate states are not exposed.
- durability: The resulting DIT state is preserved until subsequently updated.
now, when a control asks for extra DIT changes, those extra changes SHOULD NOT be treated as their own separate transaction 🫶 and the spec MUST be super clear on whether those extra changes are in the same transaction as the base request's changes, or a separate one 👑
when a control asks for extra (or different) DIT changes, the spec MUST also be clear about the order those changes and the base changes get applied in 🔥 order matters, periodt 💅
3.1.5. Extending the Responseless Operations with Controls
Abandon and Unbind don't get a response message 😭 so for controls attached to Abandon or Unbind requests, the spec SHOULD mandate that the control's criticality be FALSE 🌈
3.2. Extended Operations
Extended Operations [Protocol, Section 4.12] are the RECOMMENDED way to define new operations 🦋 an extended operation is made of an ExtendedRequest message, zero or more IntermediateResponse messages, and an ExtendedResponse message. main character energy ✨
3.3. Intermediate Responses
okay this one's short and iconic 💜 extensions SHALL use IntermediateResponse messages instead of ExtendedResponse messages when they want to return intermediate results 🎀
3.4. Unsolicited Notifications
unsolicited notifications [Protocol, Section 4.4] let the server tell the client about events that aren't tied to whatever operation is being processed right now 🔔
extensions SHOULD be designed so that unsolicited notifications only get sent when the server specifically knows the client can actually use them 🫶 usually, the client asks for a certain unsolicited notification by doing a related extended operation first 🌸
for example, a time hack extension could send unsolicited notifications on a regular schedule that was turned on by an extended operation (which might have set the interval you want) ⭐
4. Extending the LDAP ASN.1 Definition 🧩
LDAP allows limited extension [Protocol, Section 4] of the LDAP ASN.1 definition [Protocol, Appendix B] to be made 💖
4.1. Result Codes
extensions that add new operations or upgrade existing ones often need new result codes 🍓 so the extension SHOULD be designed so a client gets a reasonably clear idea of what kind of success or failure happened ✨
extensions SHOULD use existing result codes for conditions that match what those codes are meant to mean [RFC4511][X.511] 💅 extensions MAY introduce new result codes [RFC4520] when no existing code gives an adequate picture of the result 🦋
extensions SHALL NOT disallow or otherwise restrict the return of general service result codes 🚫 especially the ones reporting a protocol, service, or security problem, or saying the server can't or won't complete the operation 😭
4.2. LDAP Message Types
you can define brand new LDAP message types by extending the protocolOp CHOICE of the LDAPMessage SEQUENCE 🙈 but honestly that's generally unnecessary and not appropriate 💀 existing operation extension mechanisms (like extended operations, unsolicited notifications, and intermediate responses) SHOULD be used instead 🫶 that said, there might be times an extension just doesn't fit those mechanisms ✨
in those cases, a new extension mechanism SHOULD be defined so that multiple extensions with similar needs can use it 🌈
4.3. Authentication Methods
the Bind operation currently supports two authentication methods: simple and SASL 🔑 SASL [RFC4422] is an extensible authentication framework used by lots of application-level protocols (like BEEP, IMAP, and SMTP) 💜 it is RECOMMENDED that new authentication processes be defined as SASL mechanisms 🎀 new LDAP authentication methods MAY be added to support new authentication frameworks 🧚
the Bind operation's main job is to establish the LDAP association [RFC4513] ✨ no other operation SHALL be defined (or extended) to establish the LDAP association 🙅 however, other operations MAY be defined to establish other security associations (like IPsec) 🔐
4.4. General ASN.1 Extensibility
Section 4 of [RFC4511] says this, and it's the lore 📜
In order to support future extensions to this protocol, extensibility is implied where it is allowed per ASN.1 (i.e., sequence, set, choice, and enumerated types are extensible). In addition, ellipses (...) have been supplied in ASN.1 types that are explicitly extensible as discussed in [RFC4520]. Because of the implied extensibility, clients and servers MUST (unless otherwise specified) ignore trailing SEQUENCE components whose tags they do not recognize.
designers SHOULD avoid making extensions that depend on unsuspecting implementations ignoring trailing SEQUENCE components whose tags they don't recognize 🥹 nobody wants a surprise 😭
5. Schema Extensions 📚
extensions that define LDAP schema elements SHALL provide schema definitions that conform with the syntaxes defined in [Models, Section 4.1] 💅 the provided definitions MAY be reformatted (line wrapped) for readability, but that SHALL be noted in the specification 📝
for definitions that allow a NAME field, new schema elements SHOULD provide one and only one name 💖 and that name SHOULD be short ✨
every schema definition allows a DESC field 🎀 if you include it, the DESC field SHOULD contain a short descriptive phrase 🍓 the DESC field MUST be regarded as informational 💜 so the spec MUST be written so its interpretation is the same with and without the DESC fields 🫶
the extension SHALL NOT mandate that implementations publish the same DESC field in their schema 🙅 implementors MAY replace or remove the DESC field 🦋
published schema elements SHALL NOT be redefined 🚫 replacement schema elements (new OIDs, new NAMEs) SHOULD be defined as needed 🌸
schema designers SHOULD reuse existing schema elements where it makes sense 🧚 but any reuse MUST not alter the semantics of the element 😭
5.1. LDAP Syntaxes
each LDAP syntax [RFC4517] is defined in terms of ASN.1 [X.680] 🧩 each extension detailing an LDAP syntax MUST specify the ASN.1 data definition associated with that syntax 💅 a distinct LDAP syntax SHOULD be created for each distinct ASN.1 data definition (including constraints) 🎀
each LDAP syntax SHOULD have a string encoding defined for it ✨ it is RECOMMENDED that this string encoding be restricted to UTF-8 [RFC3629] encoded Unicode [Unicode] characters 🌈 using Generic String Encoding Rules (GSER) [RFC3641][RFC3642] or other generic string encoding rules to provide string encodings for complex ASN.1 data definitions is RECOMMENDED 🫶 otherwise, it is RECOMMENDED that the string encoding be described with a formal language (like ABNF [RFC4234]) 💜 formal languages SHOULD be used in specs in accordance with IESG guidelines [FORMAL] 🔥
if no string encoding is defined, the extension SHALL specify how the transfer encoding is to be indicated 🔐 generally, the extension SHOULD mandate use of the binary or other transfer encoding option 🍓
5.2. Matching Rules
three basic kinds of matching rules (EQUALITY, ORDERING, and SUBSTRING) may be associated with an attribute type 🧠 on top of that, LDAP has an extensible matching rule mechanism 🎀
the matching rule specification SHOULD detail which kind of matching rule it is, and SHOULD describe which kinds of values it can be used with 💖
in addition to the requirements in the LDAP technical specification, equality matching rules SHOULD be commutative ✨
5.3. Attribute Types
designers SHOULD carefully consider how the structure of values is restricted 🧐 and SHOULD keep in mind that servers will only enforce constraints of the attribute's syntax 🦋 so an attribute meant to hold URIs, but that has directoryString syntax, is NOT restricted to URI values 😭
designers SHOULD carefully consider which matching rules, if any, fit the attribute type 💅 matching rules specified for an attribute type MUST be compatible with that attribute type's syntax 🫶
extensions specifying operational attributes MUST detail how servers are to maintain and/or utilize values of each operational attribute 🔥
5.4. Object Classes
designers SHOULD carefully consider whether each attribute of an object class is required ("MUST") or allowed ("MAY") 🎀 extensions specifying object classes that allow (or require) operational attributes MUST specify how servers are to maintain and/or utilize entries belonging to those object classes 🌸
6. Other Extension Mechanisms ✨
6.1. Attribute Description Options
Okay so every option gets its own little name tag 🏷️, and that tag is just a string made of letters, numbers, and hyphens. That string SHOULD be short, bestie, because nobody wants to read a novel just to name a thing 💅
6.2. Authorization Identities
Anything that touches authorization identities SHALL support the LDAP authzId format [RFC4513] 🔐 The authzId format is extensible too, so it can grow without breaking the vibe ✨
6.3. LDAP URL Extensions
LDAP URL extensions are identified by a short string called a descriptor 🧚 Just like the other descriptors, that string SHOULD be short. Keep it snappy 💖
7. Security Considerations 🛡️
Okay, this section is serious, so read it slowly bestie 😭
LDAP does not place undue restrictions on the kinds of extensions that can be implemented. This document tries to point out some specific issues that designers need to think about, but it is not (and cannot be) all encompassing 🌸 Designers MUST do their own evaluations of the security considerations that apply to their extensions 🔥
Designers MUST NOT assume that the LDAP "core" technical specification [RFC4510] adequately addresses the specific concerns around their extensions, and they MUST NOT assume that their extensions have no specific concerns either 🙈 Not me assuming that! 💀
Extension specifications, however, SHOULD note whether the security considerations specific to the feature they are extending, as well as the general LDAP security considerations, apply to the extension 🫶
8. Acknowledgements 🎀
The author thanks the IETF LDAP community for their thoughtful comments 💜
This work builds upon "LDAP Extension Style Guide" [GUIDE] by Bruce Greenblatt 🍓
9. References 📚
9.1. Normative References
[RFC2119]Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.[RFC2434]Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.[RFC2849]Good, G., "The LDAP Data Interchange Format (LDIF) - Technical Specification", RFC 2849, June 2000.[RFC3629]Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.[RFC3641]Legg, S., "Generic String Encoding Rules (GSER) for ASN.1 Types", RFC 3641, October 2003.[RFC3642]Legg, S., "Common Elements of Generic String Encoding Rules (GSER) Encodings", RFC 3642, October 2003.[RFC4512]Zeilenga, K., "Lightweight Directory Access Protocol (LDAP): Directory Information Models", RFC 4512, June 2006.[RFC3866]Zeilenga, K., Ed., "Language Tags and Ranges in the Lightweight Directory Access Protocol (LDAP)", RFC 3866, July 2004.[RFC4234]Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", RFC 4234, October 2005.[RFC4510]Zeilenga, K., Ed., "Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map", RFC 4510, June 2006.[RFC4511]Sermersheim, J., Ed., "Lightweight Directory Access Protocol (LDAP): The Protocol", RFC 4511, June 2006.[RFC4512]Zeilenga, K., "Lightweight Directory Access Protocol (LDAP): Directory Information Models", RFC 4512, June 2006.[RFC4513]Harrison, R., Ed., "Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms", RFC 4513, June 2006.[RFC4515]Smith, M., Ed. and T. Howes, "Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters", RFC 4515, June 2006.[RFC4516]Smith, M., Ed. and T. Howes, "Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator", RFC 4516, June 2006.[RFC4517]Legg, S., Ed., "Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules", RFC 4517, June 2006.[RFC4518]Zeilenga, K., "Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names", RFC 4518, June 2006.[RFC4520]Zeilenga, K., "Internet Assigned Numbers Authority (IANA) Considerations for the Lightweight Directory Access Protocol (LDAP)", BCP 64, RFC 4520, June 2006.[RFC4422]Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple Authentication and Security Layer (SASL)", RFC 4422, June 2006.[Unicode]The Unicode Consortium, "The Unicode Standard, Version 3.2.0" is defined by "The Unicode Standard, Version 3.0" (Reading, MA, Addison-Wesley, 2000. ISBN 0-201-61633-5), as amended by the "Unicode Standard Annex #27: Unicode 3.1" (http://www.unicode.org/reports/tr27/) and by the "Unicode Standard Annex #28: Unicode 3.2" (http://www.unicode.org/reports/tr28/).[FORMAL]IESG, "Guidelines for the use of formal languages in IETF specifications",http://www.ietf.org/IESG/STATEMENTS/pseudo-code-in-specs.txt, 2001.[X.511]International Telecommunication Union - Telecommunication Standardization Sector, "The Directory: Abstract Service Definition", X.511(1993) (also ISO/IEC 9594-3:1993).[X.680]International Telecommunication Union - Telecommunication Standardization Sector, "Abstract Syntax Notation One (ASN.1) - Specification of Basic Notation", X.680(2002) (also ISO/IEC 8824-1:2002).[X.690]International Telecommunication Union - Telecommunication Standardization Sector, "Specification of ASN.1 encoding rules: Basic Encoding Rules (BER), Canonical Encoding Rules (CER), and Distinguished Encoding Rules (DER)", X.690(2002) (also ISO/IEC 8825-1:2002).
9.2. Informative References
[ACID]Section 4 of ISO/IEC 10026-1:1992.[GUIDE]Greenblatt, B., "LDAP Extension Style Guide", Work in Progress.[RFC3062]Zeilenga, K., "LDAP Password Modify Extended Operation", RFC 3062, February 2001.[RFC4346]Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.1", RFC 4346, April 2006.
Author's Address 🖊️
Kurt D. Zeilenga OpenLDAP Foundation
EMail: Kurt@OpenLDAP.org
Full Copyright Statement ⚖️
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 💎
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also does not represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 🌈
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). 🫶
📦 where this page comes from
- ietf: rfc4521 2006-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms