Skip to main content

5. DSA (Server) Informational Model

The LDAP protocol assumes there are one or more servers that jointly provide access to a Directory Information Tree (DIT). The server holding the original information is called the "master" (for that information). Servers that hold copies of the original information are referred to as "shadowing" or "caching" servers.

As defined in [X.501]:

  context prefix: The sequence of RDNs leading from the Root of the
      DIT to the initial vertex of a naming context; corresponds to
      the distinguished name of that vertex.

  naming context: A subtree of entries held in a single master DSA.

That is, a naming context is the largest collection of entries, starting at an entry that is mastered by a particular server, and including all its subordinates and their subordinates, down to the entries that are mastered by different servers. The context prefix is the name of the initial entry.

The root of the DIT is a DSA-specific Entry (DSE) and not part of any naming context (or any subtree); each server has different attribute values in the root DSE.

5.1. Server-Specific Data Requirements​

An LDAP server SHALL provide information about itself and other information that is specific to each server. This is represented as a group of attributes located in the root DSE, which is named with the DN with zero RDNs (whose [RFC4514] representation is as the zero-length string).

These attributes are retrievable, subject to access control and other restrictions, if a client performs a Search operation [RFC4511] with an empty baseObject, scope of baseObject, the filter

"(objectClass=*)" [RFC4515], and the attributes field listing the names of the desired attributes. It is noted that root DSE attributes are operational and, like other operational attributes, are not returned in search requests unless requested by name.

The root DSE SHALL NOT be included if the client performs a subtree search starting from the root.

Servers may allow clients to modify attributes of the root DSE, where appropriate.

The following attributes of the root DSE are defined below. Additional attributes may be defined in other documents.

  - altServer: alternative servers;

  - namingContexts: naming contexts;

  - supportedControl: recognized LDAP controls;

  - supportedExtension: recognized LDAP extended operations;

  - supportedFeatures: recognized LDAP features;

  - supportedLDAPVersion: LDAP versions supported; and

  - supportedSASLMechanisms: recognized Simple Authentication and
    Security Layers (SASL) [RFC4422] mechanisms.

The values provided for these attributes may depend on session- specific and other factors. For example, a server supporting the SASL EXTERNAL mechanism might only list "EXTERNAL" when the client's identity has been established by a lower level. See [RFC4513].

The root DSE may also include a 'subschemaSubentry' attribute. If it does, the attribute refers to the subschema (sub)entry holding the schema controlling the root DSE. Clients SHOULD NOT assume that this subschema (sub)entry controls other entries held by the server. General subschema discovery procedures are provided in Section 4.4.

5.1.1. 'altServer'​

The 'altServer' attribute lists URIs referring to alternative servers that may be contacted when this server becomes unavailable. URIs for servers implementing the LDAP are written according to [RFC4516]. Other kinds of URIs may be provided. If the server does not know of any other servers that could be used, this attribute will be absent. Clients may cache this information in case their preferred server later becomes unavailable.

  ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    USAGE dSAOperation )

The IA5String (1.3.6.1.4.1.1466.115.121.1.26) syntax is defined in [RFC4517].

5.1.2. 'namingContexts'​

The 'namingContexts' attribute lists the context prefixes of the naming contexts the server masters or shadows (in part or in whole). If the server is a first-level DSA [X.501], it should list (in addition) an empty string (indicating the root of the DIT). If the server does not master or shadow any information (e.g., it is an LDAP gateway to a public X.500 directory) this attribute will be absent. If the server believes it masters or shadows the entire directory, the attribute will have a single value, and that value will be the empty string (indicating the root of the DIT).

This attribute may be used, for example, to select a suitable entry name for subsequent operations with this server.

  ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
    USAGE dSAOperation )

The DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax is defined in [RFC4517].

5.1.3. 'supportedControl'​

The 'supportedControl' attribute lists object identifiers identifying the request controls [RFC4511] the server supports. If the server does not support any request controls, this attribute will be absent. Object identifiers identifying response controls need not be listed.

Procedures for registering object identifiers used to discovery of protocol mechanisms are detailed in BCP 64, RFC 4520 [RFC4520].

  ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.38
    USAGE dSAOperation )

The OBJECT IDENTIFIER (1.3.6.1.4.1.1466.115.121.1.38) syntax is defined in [RFC4517].

5.1.4. 'supportedExtension'​

The 'supportedExtension' attribute lists object identifiers identifying the extended operations [RFC4511] that the server supports. If the server does not support any extended operations, this attribute will be absent.

An extended operation generally consists of an extended request and an extended response but may also include other protocol data units (such as intermediate responses). The object identifier assigned to the extended request is used to identify the extended operation. Other object identifiers used in the extended operation need not be listed as values of this attribute.

Procedures for registering object identifiers used to discovery of protocol mechanisms are detailed in BCP 64, RFC 4520 [RFC4520].

  ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.38
    USAGE dSAOperation )

The OBJECT IDENTIFIER (1.3.6.1.4.1.1466.115.121.1.38) syntax is defined in [RFC4517].

5.1.5. 'supportedFeatures'​

The 'supportedFeatures' attribute lists object identifiers identifying elective features that the server supports. If the server does not support any discoverable elective features, this attribute will be absent.

  ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures'
      EQUALITY objectIdentifierMatch
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.38
      USAGE dSAOperation )

Procedures for registering object identifiers used to discovery of protocol mechanisms are detailed in BCP 64, RFC 4520 [RFC4520].

The OBJECT IDENTIFIER (1.3.6.1.4.1.1466.115.121.1.38) syntax and objectIdentifierMatch matching rule are defined in [RFC4517].

5.1.6. 'supportedLDAPVersion'​

The 'supportedLDAPVersion' attribute lists the versions of LDAP that the server supports.

  ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    USAGE dSAOperation )

The INTEGER (1.3.6.1.4.1.1466.115.121.1.27) syntax is defined in [RFC4517].

5.1.7. 'supportedSASLMechanisms'​

The 'supportedSASLMechanisms' attribute lists the SASL mechanisms [RFC4422] that the server recognizes and/or supports [RFC4513]. The contents of this attribute may depend on the current session state. If the server does not support any SASL mechanisms, this attribute will not be present.

  ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    USAGE dSAOperation )

The Directory String (1.3.6.1.4.1.1466.115.121.1.15) syntax is defined in [RFC4517].