Lightweight Directory Access Protocol (LDAP) Assertion Control
Extracted elements (12)
The Assertion Control enables conditional LDAP operations such as atomic 'test and set' and 'test and clear' by requiring that a filter applied to the target entry evaluate to TRUE before the operation proceeds. This mechanism supports concurrency-safe modifications without requiring separate test and update round trips.
Other documents may specify how the Assertion Control applies to additional LDAP operations beyond those defined here; such documents must state how the target entry is determined for each operation.
For Compare operations and all update operations (Add, Delete, Modify, ModifyDN), the evaluation of the assertion and the normal processing of the operation SHALL be done as one atomic action.
Servers implementing this specification SHOULD publish the OID 1.3.6.1.1.12 as a value of the 'supportedControl' attribute in their root DSE. A server MAY choose to advertise this extension only when the client is authorized to use it.
When the Assertion Control is attached to an LDAP request, if the Filter evaluates to TRUE the request is processed normally; if the Filter evaluates to FALSE or Undefined, the assertionFailed (122) result code MUST be returned and no further processing is performed.
For Search operations, the assertion is applied to the baseObject field after 'finding' but before 'searching'; no entries or continuation references are returned if the assertion fails.
The Assertion Control is appropriate for Add, Compare, Delete, Modify, ModifyDN (rename), and Search operations. It is inappropriate for Abandon, Bind, Unbind, and StartTLS operations.
The LDAP Assertion Control has controlType OID 1.3.6.1.1.12 and controlValue is a BER-encoded Filter (as defined in RFC 4511 Section 4.5.1). The criticality may be TRUE or FALSE, and there is no corresponding response control.
IANA assigned LDAP Object Identifier 1.3.6.1.1.12 to identify the LDAP Assertion Control, registered under the LDAP Protocol Mechanism registry with usage type 'Control' per RFC 4520.
IANA assigned LDAP Result Code 'assertionFailed' with value 122, registered per RFC 4520, to be returned when the Assertion Control's filter evaluates to FALSE or Undefined.
The filter may contain sensitive information and should be appropriately protected (e.g., via TLS). The assertion mechanism can be used to probe directory content, so it SHOULD be subject to appropriate access controls. Complex assertions may consume significant server resources, so administrative controls SHOULD also be applied.
The controlValue of the Assertion Control is a BER-encoded Filter as defined in RFC 4511 Section 4.5.1, encoded under the BER restrictions specified in RFC 4511 Section 5.1.