附录 B. 完整 ASN.1 定义 (Complete ASN.1 Definition)

本附录汇总 RFC 4511 使用的 ASN.1 module. 该 module 定义 LDAPMessage envelope, protocol operation choice, control, result, DN, filter, search, update, extended operation, intermediate response 和 StartTLS 等协议元素.

核心结构可以概括为:

LDAPMessage ::= SEQUENCE {
     messageID       MessageID,
     protocolOp      CHOICE {
          bindRequest           BindRequest,
          bindResponse          BindResponse,
          unbindRequest         UnbindRequest,
          searchRequest         SearchRequest,
          searchResEntry        SearchResultEntry,
          searchResDone         SearchResultDone,
          searchResRef          SearchResultReference,
          modifyRequest         ModifyRequest,
          modifyResponse        ModifyResponse,
          addRequest            AddRequest,
          addResponse           AddResponse,
          delRequest            DelRequest,
          delResponse           DelResponse,
          modDNRequest          ModifyDNRequest,
          modDNResponse         ModifyDNResponse,
          compareRequest        CompareRequest,
          compareResponse       CompareResponse,
          abandonRequest        AbandonRequest,
          extendedReq           ExtendedRequest,
          extendedResp          ExtendedResponse,
          intermediateResponse  IntermediateResponse },
     controls       [0] Controls OPTIONAL }

完整 ASN.1 定义还规定了 LDAPString, LDAPOID, LDAPDN, RelativeLDAPDN, AttributeDescription, AttributeValue, AssertionValue, LDAPResult, Referral, Filter, SubstringFilter, MatchingRuleAssertion 等类型. 这些定义与第 4 章的语义说明和第 5 章的 BER 编码规则一起构成线上的 LDAP protocol syntax.

阅读本附录时应注意, 代码块中的标识符是协议线格式的一部分, 不应翻译或本地化. 中文说明仅用于解释这些 ASN.1 类型在 LDAP 消息中的角色: messageID 用于关联请求和响应, protocolOp 表示实际操作, controls 则允许客户端或服务器携带扩展控制信息.

这些类型共同限定了 LDAP 客户端和服务器必须能够解析,编码和验证的消息结构. 实现者应将本附录与正文中的操作语义,错误码和安全要求一起阅读, 避免只依据 ASN.1 结构推断协议行为.

---