RFC 4531

Lightweight Directory Access Protocol (LDAP) Turn Operation

📅 published June 2006, from ietf

Lightweight Directory Access Protocol (LDAP) Turn Operation 🦋✨

Okay bestie, this one's an Experimental doc (so not a full Internet standard, just an "try it and tell us what you think" vibe 🧪). It's by K. Zeilenga from the OpenLDAP Foundation, dated June 2006, and it's RFC 4531. The title block doesn't list anything it obsoletes or updates, so it's not replacing or patching any other RFC 💅. This is part 1 of 2, so we'll finish the rest next 🫶

Status of This Memo 📝

This memo defines an Experimental Protocol for the Internet community. It does not specify an Internet standard of any kind. Discussion and suggestions for improvement are requested. Distribution of this memo is unlimited.

Copyright Notice ©️

Abstract 🌸

This spec describes an extended operation for LDAP (the Lightweight Directory Access Protocol) that flips the roles of client and server for the rest of the session. Or it can let each peer be a client and a server to the other one. Iconic 👑

Table of Contents 🗂️

1. Background and Intent of Use ....................................2
   1.1. Terminology ................................................2
2. Turn Operation ..................................................2
   2.1. Turn Request ...............................................3
   2.2. Turn Response ..............................................3
3. Authentication ..................................................3
   3.1. Use with TLS and Simple Authentication .....................4
   3.2. Use with TLS and SASL EXTERNAL .............................4
   3.3. Use of Mutual Authentication and SASL EXTERNAL .............4
4. TLS and SASL Security Layers ....................................5
5. Security Considerations .........................................6
6. IANA Considerations .............................................6
   6.1. Object Identifier ..........................................6
   6.2. LDAP Protocol Mechanism ....................................7
7. References ......................................................7
   7.1. Normative References .......................................7
   7.2. Informative References .....................................8

1. Background and Intent of Use 💖

Okay so LDAP [RFC4510][RFC4511] is a client-server protocol, and it usually runs over reliable octet-stream transports like TCP. Normally the client starts the stream by connecting to the server's listener at some well-known address. Simple. Predictable. Very on-brand 🎀

Sometimes though, it'd be really useful for the server to be the one who starts the stream. You could write a whole technical spec for how to do server-initiated LDAP sessions, but that would mean designing brand-new authentication and other security mechanisms just for that. Way too much drama 😭

So instead, this doc introduces the Turn operation 🔄. It lets the peer who started the connection swap roles, so that the initiating peer becomes the server once the reversal happens. Main character energy ✨

There's also a bonus feature. Turn can let both peers act in both roles. This is handy when both peers are directory servers that want to ask each other, as LDAP clients, to perform operations. Replicated and distributed setups are gonna love this 🧚

Heads up though: this is meant for peers who already have a mutual agreement, made outside the protocol, that calls for reversing the roles or letting both peers act as both client and server. You don't just Turn randomly 🙅‍♀️

1.1. Terminology 📚

Protocol elements are described using ASN.1 [X.680] with implicit tags. "BER-encoded" means the element gets encoded using the Basic Encoding Rules [X.690], under the restrictions detailed in Section 5.1 of [RFC4511]. Basically, the grammar is ASN.1 and the wire format is BER, with the extra rules from RFC 4511 on top 🤓

2. Turn Operation 🦋

The Turn operation is an LDAP-Extended Operation [Protocol, Section 4.12], identified by the OID 1.3.6.1.1.19. Its whole job is to ask for the client-server roles to be reversed. Optionally, it can instead ask that both protocol peers be able to act as both client and server with respect to each other. Two options, one vibe 💅

2.1. Turn Request 📨

The Turn request is an ExtendedRequest. Its requestName field holds the 1.3.6.1.1.19 OID, and its requestValue field is a BER-encoded turnValue:

     turnValue ::= SEQUENCE {
          mutual         BOOLEAN DEFAULT FALSE,
          identifier     LDAPString
     }

A mutual value of TRUE means "let both of us act as both client and server" 🤝. A mutual value of FALSE means "just reserve the client and server roles" (so the usual split stays, just reversed for this one turn 🔁).

The identifier field is a locally defined policy identifier. It's usually tied to the mutual agreement that this turn is part of (the original text says "is be executed as part of", which is a bit of a typo, but that's the idea 😅).

2.2. Turn Response 🎉

A Turn response is an ExtendedResponse, and both the responseName and responseValue fields are absent. The resultCode is success if and only if the responder is willing and able to turn the session the way it was asked. If not, you get a different resultCode. No success, no turn, no tea ☕

3. Authentication 🔐

This extension assumes each peer gets authenticated separately in each of its roles. After the Turn, a separate Bind exchange is expected between the peers in their new roles, so they can establish identities for those roles 🪪

Here's the tea once the Turn is done. The responding peer, now in its new client role, has an anonymous association at the initiating peer, which is now in its new server role. If the turn was mutual, the initiating peer's old client-role authentication stays intact at the responding peer's old server role. If the turn was not mutual, that old association is void 🗑️

The responding peer can set up its identity in its client role by requesting and successfully finishing a Bind operation. Easy peasy 💜

The rest of this section walks through some authentication scenarios. In the protocol exchange diagrams, A is the initiating peer (the original client) and B is the responding peer (the original server) 🎭

3.1. Use with TLS and Simple Authentication 🔒

     A->B: StartTLS Request
     B->A: StartTLS(success) Response
     A->B: Bind(Simple(cn=B,dc=example,dc=net,B's secret)) Request
     B->A: Bind(success) Response
     A->B: Turn(TRUE,"XXYYZ") Request
     B->A: Turn(success) Response
     B->A: Bind(Simple(cn=A,dc=example,dc=net,A's secret)) Request
     A->B: Bind(success) Response

So in this one, TLS (Transport Layer Security) [RFC4346] gets started. Before the Turn, the initiating peer (the original client) proves who it is to the responding peer, using the DN/password route of the Simple method of the Bind operation 🗝️. After the turn, the responding peer (now a client) proves its identity to the initiating peer (now a server) the same way. Fair is fair 🫶

3.2. Use with TLS and SASL EXTERNAL 🪄

     A->B: StartTLS Request
     B->A: StartTLS(success) Response
     A->B: Bind(SASL(EXTERNAL)) Request
     B->A: Bind(success) Response
     A->B: Turn(TRUE,"XXYYZ") Request
     B->A: Turn(success) Response
     B->A: Bind(SASL(EXTERNAL)) Request
     A->B: Bind(success) Response

In this scenario, TLS gets started, and each peer shows a valid certificate 📜. Before the Turn, the initiating peer (the original client) identifies itself using the EXTERNAL mechanism of the SASL (Simple Authentication and Security Layer) [RFC4422] method of the Bind operation. After the turn, the responding peer, now a client, identifies itself to the initiating peer, now a server, the same way ✨

3.3. Use of Mutual Authentication and SASL EXTERNAL 🤝

A bunch of SASL mechanisms, like GSSAPI [SASL-K5], support mutual authentication. The initiating peer, once it's in its new server role, can use the identity of the responding peer (set up by an earlier authentication exchange) as its source for "external" identity in later EXTERNAL exchanges. Big brain move 🧠

     A->B: Bind(SASL(GSSAPI)) Request
     <intermediate messages>
     B->A: Bind(success) Response
     A->B: Turn(TRUE,"XXYYZ") Request
     B->A: Turn(success) Response
     B->A: Bind(SASL(EXTERNAL)) Request
     A->B: Bind(success) Response

In this one, a GSSAPI mutual-authentication exchange finishes between the initiating peer (the original client) and the responding server (the original server) before the turn. After the turn, the responding peer, now in its new client role, asks the initiating peer to use an "external" identity to establish its LDAP authorization identity. Iconic behavior, honestly 👑

5. Security Considerations 🔐

okay bestie, this section is SERIOUS so pay attention 🫶 implementors should know that flipping the client/server roles, and/or letting both peers act as client AND server, probably brings security stuff the authors never saw coming 😭 the security implications of the auth and data security choices (Sections 3 and 4) aren't fully studied yet. we're hoping experimenting with this extension helps us understand those models and everything else about it, and that the good considerations get written down in a future document. here's what's obvious right now:

Implementors should take special care to process LDAP, SASL, TLS, and other events in the appropriate roles for the peers. ✨ note that even though the Turn reverses the client/server roles for LDAP and for SASL auth exchanges, it does NOT reverse the roles within the TLS layer or the transport connection. so keep track of who's who 💅

the responding server (the original server) should restrict use of this operation to authorized clients. 🚫 knowing a valid identifier should not be the only thing deciding whether someone is allowed to turn. main character energy for security is not "I know the name" 🙈

where the peers expect to establish TLS, TLS should be started before the Turn and before any request to authenticate via the Bind operation. 🔒 order matters, periodt.

LDAP security considerations [RFC4511][RFC4513] generally apply to this extension. 📚 so go read those too!

6. IANA Considerations 🎀

the IANA has registered the following values [RFC4520]. 💖

6.1. Object Identifier

the IANA assigned an LDAP Object Identifier to identify the LDAP Turn Operation, as defined in this document. 🦋

    Subject: Request for LDAP Object Identifier Registration
    Person & email address to contact for further information:
         Kurt Zeilenga <kurt@OpenLDAP.org>
    Specification: RFC 4531
    Author/Change Controller: Author
    Comments:
         Identifies the LDAP Turn Operation

6.2. LDAP Protocol Mechanism

the IANA registered the LDAP Protocol Mechanism described in this document. 🌸

    Subject: Request for LDAP Protocol Mechanism Registration
    Object Identifier: 1.3.6.1.1.19
    Description: LDAP Turn Operation
    Person & email address to contact for further information:
         Kurt Zeilenga <kurt@openldap.org>
    Usage: Extended Operation
    Specification: RFC 4531
    Author/Change Controller: Author
    Comments: none

7. References 📖

7.1. Normative References

these are the must-read sources, bestie 🧚

[RFC4346]     Dierks, T. and, E. Rescorla, "The Transport Layer
              Security (TLS) Protocol Version 1.1", RFC 4346, April
              2006.

[RFC4422]     Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple
              Authentication and Security Layer (SASL)", RFC 4422,
              June 2006.

[RFC4510]     Zeilenga, K., Ed., "Lightweight Directory Access
              Protocol (LDAP): Technical Specification Road Map", RFC
              4510, June 2006.

[RFC4511]     Sermersheim, J., Ed., "Lightweight Directory Access
              Protocol (LDAP): The Protocol", RFC 4511, June 2006.

[RFC4513]     Harrison, R., Ed., "Lightweight Directory Access
              Protocol (LDAP): Authentication Methods and Security
              Mechanisms", RFC 4513, June 2006.

[X.680]       International Telecommunication Union -
              Telecommunication Standardization Sector, "Abstract
              Syntax Notation One (ASN.1) - Specification of Basic
              Notation", X.680(2002) (also ISO/IEC 8824-1:2002).

[X.690]       International Telecommunication Union -
              Telecommunication Standardization Sector,
              "Specification of ASN.1 encoding rules: Basic Encoding
              Rules (BER), Canonical Encoding Rules (CER), and
              Distinguished Encoding Rules (DER)", X.690(2002) (also
              ISO/IEC 8825-1:2002).

7.2. Informative References

these are the extra-credit reads 🌈

[RFC4520]     Zeilenga, K., "Internet Assigned Numbers Authority
              (IANA) Considerations for the Lightweight Directory
              Access Protocol (LDAP)", BCP 64, RFC 4520, June 2006.

[SASL-K5]     Melnikov, A., Ed., "The Kerberos V5 ("GSSAPI") SASL
              Mechanism", Work in Progress, May 2006.

Author's Address 💜

Kurt D. Zeilenga
OpenLDAP Foundation

EMail: Kurt@OpenLDAP.org

Full Copyright Statement ⭐

this document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth there, the authors keep all their rights.

this document and the information in it are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🫠

Intellectual Property 🎁

the IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to apply to implementing or using the technology in this document, or on whether any license under those rights might be available. it also doesn't claim to have made any independent effort to find such rights. info on the procedures for rights in RFC documents is in BCP 78 and BCP 79.

copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, and the results of any attempt to get a general license or permission to use such proprietary rights by implementers or users of this specification can be found in the IETF online IPR repository at http://www.ietf.org/ipr. 📑

the IETF invites any interested party to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that may cover technology required to implement this standard. send that info to the IETF at ietf-ipr@ietf.org. 💌

Acknowledgement 🌷

funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). 🫶✨

📦 where this page comes from

ietf: rfc4531 2006-06
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms