The Lightweight Directory Access Protocol (LDAP) Don't Use Copy Control
Extracted elements (13)
The control is based on the X.511 dontUseCopy service control option and is intended for cases where a client requires service using original (master) information rather than replicated or cached copies. Without this control, servers are free to use non-authoritative information.
The control is not intended for general use across all LDAP interrogation operations, but only as required to ensure proper directory application behavior. Directory applications ought to be designed to use copied information well.
The Don't Use Copy control is appropriate only for LDAP interrogation operations (Compare and Search). It is inappropriate for Abandon, Bind, Delete, Modify, ModifyDN, StartTLS, and Unbind operations.
If original information for the target or base object is not available locally or through chaining, the server MUST either return a referral or an appropriate result code such as unwillingToPerform.
Servers implementing this specification SHOULD publish OID 1.3.6.1.1.22 as a value of the 'supportedControl' attribute in their root DSE. A server MAY choose to advertise this extension only when the client is authorized to use it.
The criticality of the Don't Use Copy control MUST be TRUE.
When a client chases a referral to obtain an authoritative response, it MUST provide the dontUseCopy control with the interrogation request sent to the referred-to server.
When the Don't Use Copy control is attached to an LDAP request, the requested operation MUST NOT be performed on copied information; it MUST be performed on original (master) information.
The Don't Use Copy control has controlType OID 1.3.6.1.1.22, an absent controlValue, and criticality MUST be TRUE. There is no corresponding response control.
IANA assigned LDAP Object Identifier 1.3.6.1.1.22 to identify the LDAP Don't Use Copy Control as defined in this document.
IANA registered OID 1.3.6.1.1.22 as an LDAP Protocol Mechanism with usage type 'Control' and description 'Don't Use Copy Control' per RFC 4520.
LDAP is frequently used for security-sensitive information including access control and security policy. Failure to use the Don't Use Copy control when authoritative data is required may permit unauthorized access by allowing reliance on stale replicated data.
Use of the Don't Use Copy control may permit an attacker to amplify a denial-of-service attack by causing the server to consume additional resources through chaining instead of returning a referral. Servers can mitigate this by limiting chaining to authenticated entities.