Lightweight Directory Access Protocol (LDAP) Read Entry Controls
Extracted elements (16)
The controls are intended for use cases such as obtaining replaced or deleted attribute values via Pre-Read, and reading server-updated operational attributes (e.g., entryUUID, modifyTimestamp) via Post-Read after an update completes.
The Pre-Read and Post-Read controls are modeled after similar capabilities in the X.500 Directory Access Protocol (DAP) [X.511], bringing analogous read-with-update semantics to LDAP.
The Pre-Read and Post-Read controls may be combined with each other and with the assertion control (RFC 4528) and/or the manageDsaIT control (RFC 3296); the semantics of each control in the combination applies independently.
If the update operation fails (in either normal or control processing), no Post-Read response control is provided.
Servers implementing the Post-Read controls SHOULD publish 1.3.6.1.1.13.2 as a value of the 'supportedControl' attribute in their root DSE.
Servers implementing the Pre-Read controls SHOULD publish 1.3.6.1.1.13.1 as a value of the 'supportedControl' attribute in their root DSE.
The normal processing of the update operation and the processing of the Post-Read control MUST be performed as one atomic action isolated from other update operations.
The Post-Read response control is appropriate only for addResponse, modifyResponse, and modDNResponse messages with a resultCode of success (0).
The Pre-Read response control is appropriate only for modifyResponse, delResponse, and modDNResponse messages with a resultCode of success (0).
The Post-Read request control is identified by OID 1.3.6.1.1.13.2. Its controlValue is a BER-encoded AttributeSelection and it is appropriate for addRequest, modifyRequest, and modDNRequest messages. The corresponding response control returns a BER-encoded SearchResultEntry.
The Pre-Read request control is identified by OID 1.3.6.1.1.13.1. Its controlValue is a BER-encoded AttributeSelection and it is appropriate for modifyRequest, delRequest, and modDNRequest messages. The corresponding response control returns a BER-encoded SearchResultEntry.
IANA registered LDAP Object Identifier for the LDAP Read Entry Controls under RFC 4527, with Author/Change Controller IESG.
IANA registered two LDAP Protocol Mechanisms: OID 1.3.6.1.1.13.1 (LDAP Pre-read Control) and OID 1.3.6.1.1.13.2 (LDAP Post-read Control), both with Usage: Control and Specification: RFC 4527.
Servers MUST ensure that the client is authorized both for reading the information returned in the read entry control and for performing the requested directory update operation. These are separate authorization checks.
The Post-Read request control's controlValue is a BER-encoded AttributeSelection (as defined in RFC 4511 and extended by RFC 3673), encoded as an OCTET STRING. The response control's controlValue is a BER-encoded SearchResultEntry.
The Pre-Read request control's controlValue is a BER-encoded AttributeSelection (as defined in RFC 4511 and extended by RFC 3673), encoded as an OCTET STRING. The response control's controlValue is a BER-encoded SearchResultEntry.