📄 rfc1777.txt
字号:
client to the server. The Bind Operation must be the first operation
request received by a server from a client in a protocol session.
The Bind Request is defined as follows:
BindRequest ::=
[APPLICATION 0] SEQUENCE {
version INTEGER (1 .. 127),
name LDAPDN,
authentication CHOICE {
simple [0] OCTET STRING,
krbv42LDAP [1] OCTET STRING,
krbv42DSA [2] OCTET STRING
}
}
Parameters of the Bind Request are:
- version: A version number indicating the version of the protocol to
be used in this protocol session. This document describes version
2 of the LDAP protocol. Note that there is no version negotiation,
and the client should just set this parameter to the version it
desires.
Yeong, Howes & Kille [Page 6]
RFC 1777 LDAP March 1995
- name: The name of the Directory object that the client wishes to
bind as. This field may take on a null value (a zero length
string) for the purposes of anonymous binds.
- authentication: information used to authenticate the name, if any,
provided in the Bind Request. The "simple" authentication option
provides minimal authentication facilities, with the contents of
the authentication field consisting only of a cleartext password.
This option should also be used when unauthenticated or anonymous
binds are to be performed, with the field containing a zero length
string in such cases. Kerberos version 4 [7] authentication to the
LDAP server and the DSA is accomplished by using the "krbv42LDAP"
and "krbv42DSA" authentication options, respectively. Note that
though they are referred to as separate entities here, there is no
requirement these two entities be distinct (i.e., a DSA could speak
LDAP directly). Two separate authentication options are provided
to support all implementations. Each octet string should contain
the kerberos ticket (e.g., as returned by krb_mk_req()) for the
appropriate service. The suggested service name for authentication
to the LDAP server is "ldapserver". The suggested service name for
authentication to the DSA is "x500dsa". In both cases, the
suggested instance name for the service is the name of the host on
which the service is running. Of course, the actual service names
and instances will depend on what is entered in the local kerberos
principle database.
The Bind Operation requires a response, the Bind Response, which is
defined as:
BindResponse ::= [APPLICATION 1] LDAPResult
A Bind Response consists simply of an indication from the server of
the status of the client's request for the initiation of a protocol
session.
Upon receipt of a Bind Request, a protocol server will authenticate
the requesting client if necessary, and attempt to set up a protocol
session with that client. The server will then return a Bind Response
to the client indicating the status of the session setup request.
4.2. Unbind Operation
The function of the Unbind Operation is to terminate a protocol
session. The Unbind Operation is defined as follows:
UnbindRequest ::= [APPLICATION 2] NULL
Yeong, Howes & Kille [Page 7]
RFC 1777 LDAP March 1995
The Unbind Operation has no response defined. Upon transmission of an
UnbindRequest, a protocol client may assume that the protocol session
is terminated. Upon receipt of an UnbindRequest, a protocol server
may assume that the requesting client has terminated the session and
that all outstanding requests may be discarded.
4.3. Search Operation
The Search Operation allows a client to request that a search be
performed on its behalf by a server. The Search Request is defined as
follows:
SearchRequest ::=
[APPLICATION 3] SEQUENCE {
baseObject LDAPDN,
scope ENUMERATED {
baseObject (0),
singleLevel (1),
wholeSubtree (2)
},
derefAliases ENUMERATED {
neverDerefAliases (0),
derefInSearching (1),
derefFindingBaseObj (2),
derefAlways (3)
},
sizeLimit INTEGER (0 .. maxInt),
timeLimit INTEGER (0 .. maxInt),
attrsOnly BOOLEAN,
filter Filter,
attributes SEQUENCE OF AttributeType
}
Filter ::=
CHOICE {
and [0] SET OF Filter,
or [1] SET OF Filter,
not [2] Filter,
equalityMatch [3] AttributeValueAssertion,
substrings [4] SubstringFilter,
greaterOrEqual [5] AttributeValueAssertion,
lessOrEqual [6] AttributeValueAssertion,
present [7] AttributeType,
approxMatch [8] AttributeValueAssertion
}
SubstringFilter
SEQUENCE {
Yeong, Howes & Kille [Page 8]
RFC 1777 LDAP March 1995
type AttributeType,
SEQUENCE OF CHOICE {
initial [0] LDAPString,
any [1] LDAPString,
final [2] LDAPString
}
}
Parameters of the Search Request are:
- baseObject: An LDAPDN that is the base object entry relative to
which the search is to be performed.
- scope: An indicator of the scope of the search to be performed. The
semantics of the possible values of this field are identical to the
semantics of the scope field in the Directory Search Operation.
- derefAliases: An indicator as to how alias objects should be
handled in searching. The semantics of the possible values of
this field are, in order of increasing value:
neverDerefAliases: do not dereference aliases in searching
or in locating the base object of the search;
derefInSearching: dereference aliases in subordinates of
the base object in searching, but not in locating the
base object of the search;
derefFindingBaseObject: dereference aliases in locating
the base object of the search, but not when searching
subordinates of the base object;
derefAlways: dereference aliases both in searching and in
locating the base object of the search.
- sizelimit: A sizelimit that restricts the maximum number of entries
to be returned as a result of the search. A value of 0 in this
field indicates that no sizelimit restrictions are in effect for
the search.
- timelimit: A timelimit that restricts the maximum time (in seconds)
allowed for a search. A value of 0 in this field indicates that no
timelimit restrictions are in effect for the search.
- attrsOnly: An indicator as to whether search results should contain
both attribute types and values, or just attribute types. Setting
this field to TRUE causes only attribute types (no values) to be
returned. Setting this field to FALSE causes both attribute types
Yeong, Howes & Kille [Page 9]
RFC 1777 LDAP March 1995
and values to be returned.
- filter: A filter that defines the conditions that must be fulfilled
in order for the search to match a given entry.
- attributes: A list of the attributes from each entry found as a
result of the search to be returned. An empty list signifies that
all attributes from each entry found in the search are to be
returned.
The results of the search attempted by the server upon receipt of a
Search Request are returned in Search Responses, defined as follows:
Search Response ::=
CHOICE {
entry [APPLICATION 4] SEQUENCE {
objectName LDAPDN,
attributes SEQUENCE OF SEQUENCE {
AttributeType,
SET OF AttributeValue
}
},
resultCode [APPLICATION 5] LDAPResult
}
Upon receipt of a Search Request, a server will perform the necessary
search of the DIT.
The server will return to the client a sequence of responses
comprised of:
- Zero or more Search Responses each consisting of an entry found
during the search; with the response sequence terminated by
- A single Search Response containing an indication of success, or
detailing any errors that have occurred.
Each entry returned will contain all attributes, complete with
associated values if necessary, as specified in the 'attributes'
field of the Search Request.
Note that an X.500 "list" operation can be emulated by a one-level
LDAP search operation with a filter checking for the existence of the
objectClass attribute, and that an X.500 "read" operation can be
emulated by a base object LDAP search operation with the same filter.
Yeong, Howes & Kille [Page 10]
RFC 1777 LDAP March 1995
4.4. Modify Operation
The Modify Operation allows a client to request that a modification
of the DIB be performed on its behalf by a server. The Modify
Request is defined as follows:
ModifyRequest ::=
[APPLICATION 6] SEQUENCE {
object LDAPDN,
modification SEQUENCE OF SEQUENCE {
operation ENUMERATED {
add (0),
delete (1),
replace (2)
},
modification SEQUENCE {
type AttributeType,
values SET OF
AttributeValue
}
}
}
Parameters of the Modify Request are:
- object: The object to be modified. The value of this field should
name the object to be modified after all aliases have been
dereferenced. The server will not perform any alias dereferencing
in determining the object to be modified.
- A list of modifications to be performed on the entry to be modified.
The entire list of entry modifications should be performed
in the order they are listed, as a single atomic operation. While
individual modifications may violate the Directory schema, the
resulting entry after the entire list of modifications is performed
must conform to the requirements of the Directory schema. The
values that may be taken on by the 'operation' field in each
modification construct have the following semantics respectively:
add: add values listed to the given attribute, creating
the attribute if necessary;
delete: delete values listed from the given attribute,
removing the entire attribute if no values are listed, or
if all current values of the attribute are listed for
deletion;
Yeong, Howes & Kille [Page 11]
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -