Lightweight Directory Access Protocol (LDAP) Absolute True and False Filters
Extracted elements (14)
Absolute True and False filters were eliminated from LDAPv3 because the LDAPv2 string representation could not represent empty 'and'/'or' filter sets, even though LDAPv2 binary protocol placed no such restriction. This document restores them to enable direct DAP-to-LDAP gateway mapping.
These filters are commonly used when requesting DSA-specific Entries (DSEs) that do not necessarily have 'objectClass' attributes, where "(objectClass=*)" may evaluate to False.
This feature is intended to allow a more direct mapping between DAP (X.500 Directory Access Protocol) and LDAP, as needed to implement DAP-to-LDAP gateways. X.500 DAP already natively supports these absolute True/False assertions.
An 'and' filter consisting of an empty set of filters SHALL evaluate to True. This filter is represented by the string "(&)".
An 'or' filter consisting of an empty set of filters SHALL evaluate to False. This filter is represented by the string "(|)".
Clients supporting this feature SHOULD NOT use the feature unless they know that the server supports it.
Implementations of this extension SHALL allow 'and' and 'or' choices with zero filter elements, enabling absolute True and False filters in LDAP search operations.
Servers supporting this feature SHOULD publish the Object Identifier 1.3.6.1.4.1.4203.1.5.3 as a value of the 'supportedFeatures' attribute in the root DSE.
The absolute False filter is an 'or' filter with zero elements, represented as "(|)". It always evaluates to False regardless of the entry's attributes.
The absolute True filter is an 'and' filter with zero elements, represented as "(&)". It always evaluates to True regardless of the entry's attributes.
IANA registered the LDAP Protocol Mechanism OID 1.3.6.1.4.1.4203.1.5.3 with the description 'True/False filters' for this feature, per RFC 4520.
The (re)introduction of absolute True and False filters is not believed to raise any new security considerations. Implementors should be familiar with general LDAPv3 security considerations per RFC 4510.
The string representation of the absolute False filter is "(|)" — an 'or' filterlist with an empty set of filters encoded per RFC 4515.
The string representation of the absolute True filter is "(&)" — an 'and' filterlist with an empty set of filters encoded per RFC 4515.