Lightweight Directory Access Protocol version 3 (LDAPv3): All Operational Attributes
Extracted elements (10)
Certain expensive-to-compute operational attributes may only be returned if requested by name, even when "+" is present, to avoid performance penalties from unconditionally materializing costly attributes.
The mechanism uses a single ASCII "+" character so that existing LDAP clients (including web browsers with LDAP URL support) can request all operational attributes without protocol or API changes. Compatibility with deployed clients was a primary design constraint.
Servers that have not yet implemented this specification should ignore "+" as an unrecognized attribute description per RFC 2251 Section 4.5.1. From the client perspective, a server not returning all operational attributes when "+" is requested should be treated as having access restrictions.
The "+" mechanism is designed to be compatible with existing general purpose LDAP clients including those supporting LDAP URLs (RFC 2255), and is believed to require no modification of existing LDAP APIs.
Implementations SHOULD implement appropriate access control mechanisms to restrict access to operational attributes, since the "+" mechanism enables broad discovery of those attributes.
Servers supporting this feature SHOULD publish the OID 1.3.6.1.4.1.4203.1.5.1 as a value of the 'supportedFeatures' attribute in the root DSE to advertise support.
The presence of "+" in the Search Request attribute list SHALL signify a request for all operational attributes to be returned.
The attribute description "+" (ASCII 43) in the list of attributes in a Search Request signifies a request for the return of all operational attributes. This extends LDAPv3 to allow clients to discover which operational attributes are present in an entry.
OID 1.3.6.1.4.1.4203.1.5.1 is registered in the LDAP Protocol Mechanisms registry (via RFC 3674 and RFC 3383) under the description "All Op Attrs" as a Feature, assigned by OpenLDAP Foundation under its IANA private enterprise allocation.
Prior to this extension, operational attributes were only returned when requested by name, which some viewed as an obscurity feature. This document notes that was a false sense of security since the attributes were always transferable; implementations should use proper access controls rather than relying on obscurity.