RFC 4528

Lightweight Directory Access Protocol (LDAP) Assertion Control

📅 published June 2006, from ietf

Lightweight Directory Access Protocol (LDAP) Assertion Control 🎀

Okay so here's the vibe: this is RFC 4528, a Standards Track doc from June 2006, written by Kurt D. Zeilenga of the OpenLDAP Foundation. It's a proper Internet standards-track protocol spec 💅. The document doesn't list any Obsoletes or Updates, so it doesn't replace or modify another RFC.

Status of This Memo 📜

This is an Internet standards-track protocol for the Internet community, and it's literally asking for discussion and suggestions 🫶. For the current standardization state and status, check the "Internet Official Protocol Standards" (STD 1) doc. Distribution of this memo is unlimited ✨.

Copyright Notice ©️

Abstract 🦋

This doc defines the Lightweight Directory Access Protocol (LDAP) Assertion Control. It lets a client say "only do this operation if an assertion on the target entry is true" 👑. That's the whole magic trick, and it's how you build "test and set", "test and clear", and other conditional ops.

Table of Contents 🌸

1. Overview ........................................................2
2. Terminology .....................................................2
3. The Assertion Control ...........................................2
4. Security Considerations .........................................3
5. IANA Considerations .............................................4
   5.1. Object Identifier ..........................................4
   5.2. LDAP Protocol Mechanism ....................................4
   5.3. LDAP Result Code ...........................................4
6. Acknowledgements ................................................5
7. References ......................................................5
   7.1. Normative References .......................................5
   7.2. Informative References .....................................5

1. Overview 🧚

Okay so this doc defines the LDAP [RFC4510] assertion control. The assertion control lets the client specify a condition that has to be true for the operation to be processed normally 💖. If it isn't true, the operation just doesn't happen. For example, you can pair the control with the Modify operation [RFC4511] to do atomic "test and set" and "test and clear" ops. Iconic 😭.

The control can be attached to any update operation, so you can do conditional add, delete, modify, and rename on the target object 🔥. The asserted condition gets evaluated as an integral part of the operation, not as an afterthought.

The control also works with the search operation 🔍. Here the assertion is applied to the base object of the search before searching for objects that match the search scope and filter.

And yep, the control works with the compare operation too 💅. In that case it extends compare so you can make a more complex assertion.

2. Terminology 📚

Protocol elements are described using ASN.1 [X.680] with implicit tags 🎀. "BER-encoded" means the element gets encoded using the Basic Encoding Rules [X.690], under the restrictions in Section 5.1 of [RFC4511].

DSA stands for Directory System Agent (or server). DSE stands for DSA-specific Entry 🌈.

In this document, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are interpreted as described in BCP 14 [RFC2119] 🫶. These are the capital-letter requirement words, so pay attention to them, bestie 👀.

3. The Assertion Control ✨

This is the main event 👑. The assertion control is an LDAP Control [RFC4511] whose controlType is 1.3.6.1.1.12 and whose controlValue is a BER-encoded Filter [Protocol, Section 4.5.1] 💜. The criticality may be TRUE or FALSE. There's no corresponding response control, so nothing comes back on that front.

The control fits both LDAP interrogation and update operations [RFC4511], including Add, Compare, Delete, Modify, ModifyDN (rename), and Search 🍓. It's not appropriate for Abandon, Bind, Unbind, and StartTLS operations 🙈.

When the control is attached to a request, the processing of that request depends on the Filter being evaluated against the target of the operation 🦋. If the Filter evaluates to TRUE, the request is processed normally 🎉. If the Filter evaluates to FALSE or Undefined, the server returns assertionFailed (122) resultCode, and no further processing happens 💀.

For Add, Compare, and ModifyDN operations, the target is indicated by the entry field in the request. For Modify operations, it's the object field. For Delete operations, it's the DelRequest type. For Compare operations and all update operations, the evaluation of the assertion MUST be performed as an integral part of the operation 😤. In other words, the evaluation of the assertion and the normal processing of the operation SHALL be done as one atomic action ⚡. No splitting it up, periodt.

For Search operations, the target is indicated by the baseObject field, and the evaluation happens after "finding" but before "searching" [RFC4511] 🔎. Hence, if the assertion fails, no entries or continuations references get returned 🙅‍♀️.

Servers implementing this technical specification SHOULD publish the object identifier 1.3.6.1.1.12 as a value of the 'supportedControl' attribute [RFC4512] in their root DSE 📢. A server MAY choose to advertise this extension only when the client is authorized to use it 🔐.

Other documents may specify how this control applies to other LDAP operations 🧩. When they do, they must state how the target entry is determined 📝.

4. Security Considerations 🔐💀

Okay this section is serious, so listen up 🫶. The filter may, like other components of the request, contain sensitive information. When it does, this information should be appropriately protected.

As with any general assertion mechanism, this one can be used to determine directory content 👀. Hence, this mechanism SHOULD be subject to appropriate access controls 🔒.

Some assertions may be very complex and need significant time and resources to evaluate 🐌. Hence, this mechanism SHOULD be subject to appropriate administrative controls 🛡️.

The security considerations for the base operations [RFC4511] that this control extends, plus the general LDAP security considerations [RFC4510], generally apply to implementing and using this extension 💅.

5. IANA Considerations 🧾

5.1. Object Identifier 🆔

IANA has assigned an LDAP Object Identifier [RFC4520] to identify the LDAP Assertion Control defined here ✨.

    Subject: Request for LDAP Object Identifier Registration
    Person & email address to contact for further information:
        Kurt Zeilenga <kurt@OpenLDAP.org>
    Specification: RFC 4528
    Author/Change Controller: IESG
    Comments:
        Identifies the LDAP Assertion Control

5.2. LDAP Protocol Mechanism 🧩

Registration of this protocol mechanism [RFC4520] is requested 🙏.

    Subject: Request for LDAP Protocol Mechanism Registration
    Object Identifier: 1.3.6.1.1.12
    Description: Assertion Control
    Person & email address to contact for further information:
        Kurt Zeilenga <kurt@openldap.org>
    Usage: Control
    Specification: RFC 4528
    Author/Change Controller: IESG
    Comments: none

5.3. LDAP Result Code 🚦

IANA has assigned an LDAP Result Code [RFC4520] called 'assertionFailed' (122) 🎀.

    Subject: LDAP Result Code Registration
    Person & email address to contact for further information:
        Kurt Zeilenga <kurt@OpenLDAP.org>
    Result Code Name: assertionFailed
    Specification: RFC 4528
    Author/Change Controller: IESG
    Comments:  none

6. Acknowledgements 💜

The assertion control concept is credited to Morteza Ansari 🙌.

7. References 📖

7.1. Normative References

[RFC2119]     Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC4510]     Zeilenga, K., Ed., "Lightweight Directory Access
              Protocol (LDAP): Technical Specification Road Map", RFC
              4510, June 2006.

[RFC4511]     Sermersheim, J., Ed., "Lightweight Directory Access
              Protocol (LDAP): The Protocol", RFC 4511, June 2006.

[RFC4512]     Zeilenga, K., "Lightweight Directory Access Protocol
              (LDAP): Directory Information Models", RFC 4512, June
              2006.

[X.680]       International Telecommunication Union -
              Telecommunication Standardization Sector, "Abstract
              Syntax Notation One (ASN.1) - Specification of Basic
              Notation", X.680(2002) (also ISO/IEC 8824-1:2002).

[X.690]       International Telecommunication Union -
              Telecommunication Standardization Sector,
              "Specification of ASN.1 encoding rules: Basic Encoding
              Rules (BER), Canonical Encoding Rules (CER), and
              Distinguished Encoding Rules (DER)", X.690(2002) (also
              ISO/IEC 8825-1:2002).

7.2. Informative References

[RFC4520]     Zeilenga, K., "Internet Assigned Numbers Authority
              (IANA) Considerations for the Lightweight Directory
              Access Protocol (LDAP)", BCP 64, RFC 4520, June 2006.

Author's Address 📮

Kurt D. Zeilenga OpenLDAP Foundation

EMail: Kurt@OpenLDAP.org

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth there, the authors keep all their rights. This document and the info in it are provided on an "AS IS" basis, and the contributor, the organization they represent or are sponsored by (if any), the Internet Society, and the Internet Engineering Task Force all DISCLAIM ALL WARRANTIES, express or implied. That includes, but isn't limited to, any warranty that using the info won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose 🙃.

Intellectual Property 🧠

The IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to apply to implementing or using the technology described here. It also doesn't say whether any license for those rights is or isn't available, and it hasn't made any independent effort to find such rights 🤷‍♀️. Info on how rights work for RFC documents is in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt to get a general license or permission to use such proprietary rights by implementers or users of this spec can be obtained from the IETF online IPR repository at http://www.ietf.org/ipr 📬.

The IETF invites any interested party to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that may cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 💌.

Acknowledgement 🌷

Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA) 💖.

📦 where this page comes from

ietf: rfc4528 2006-06
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms