Lightweight Directory Access Protocol (LDAP) "Who am I?" Operation
Extracted elements (15)
Servers may associate multiple authorization identities with a client, each representable by multiple authzId strings. This operation specifically requests and returns only the primary authzId, simplifying client handling.
The operation is also useful independent of Bind — for example, it can be combined with a Proxied Authorization Control to discover what identity the server maps an assumed identity to, or it can be used prior to the Bind operation.
This operation is intended to replace RFC 3829 Authorization Identity Controls because Bind request/response controls are not protected by the security layers established by the Bind operation that includes them. An extended operation sent after a Bind is protected by those security layers.
Clients MUST NOT invoke the 'Who am I?' operation while any Bind operation is in progress, including between two Bind requests in a multi-stage Bind. Violations should result in the server returning an operationsError resultCode.
If the server is unwilling or unable to provide the authorization identity, it SHALL return a whoami Response with an appropriate non-success resultCode (e.g., operationsError, confidentialityRequired, insufficientAccessRights) and an absent response field.
If the server is willing and able to provide the authorization identity, it SHALL return a whoami Response with a success resultCode. If the client is anonymous, the response field is present but empty; otherwise it contains the authzId.
The server SHOULD advertise the whoamiOID in the 'supportedExtension' attribute of its root DSE only when the client is willing and able to perform this operation.
The 'Who am I?' operation can be extended with controls to request the authorization identity in a particular context. When a Proxied Authorization Control (RFC 4370) is attached, the operation returns the authzId the server associates with the assumed identity asserted in that control.
The 'Who am I?' operation is an LDAP Extended Operation identified by the OID 1.3.6.1.4.1.4203.1.11.3 (whoamiOID). It allows clients to obtain the primary authorization identity the server has associated with them.
When a Proxied Authorization Control is attached and the server does not allow the client to assume the asserted identity, the authorizationDenied (123) result code is returned.
OID 1.3.6.1.4.1.4203.1.11.3 is registered with IANA as the LDAP 'Who am I?' extended operation under the OpenLDAP Foundation's private enterprise allocation. Registration follows RFC 4520 procedures.
Authorization identities may be sensitive information. Security layers established by a Bind operation should be used to protect the integrity and confidentiality of the authorization identity returned by the 'Who am I?' operation.
Servers may place access control or other restrictions on use of the 'Who am I?' operation, and should advertise support only when willing and able to perform it. General LDAP security considerations from RFC 4510 apply.
The whoami request is an ExtendedRequest with requestName set to the whoamiOID ('1.3.6.1.4.1.4203.1.11.3') and an absent requestValue field. Example encoding: 30 1e 02 01 02 77 19 80 17 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 31 31 2e 33.
The whoami response is an ExtendedResponse where the responseName field is absent and the response field, if present, is either empty (anonymous) or an authzId string. Example encoding for 'u:[email protected]': 30 21 02 01 02 78 1c 0a 01 00 04 00 04 00 8b 13 75 3a 78 78 79 79 7a 40 45 58 41 4d 50 4c 45 2e 4e 45 54.