SearchRequest SearchResultEntry SearchResultDone

Reads attributes from a single MO, from MOs immediately below a particular MO, or a whole subtree of MOs.

ModifyRequest ModifyResponse

Add, delete, or replace values of a given attribute of an MO.

AddRequest AddResponse

Creates an MO instance.

DelRequest DelResponse

Deletes one MO instance.

AbandonRequest

Requests that the server abandons an outstanding operation.

CompareRequest CompareResponse

Allows a client to compare an assertion provided with an MO.

baseObject = LDAPDN (OCTET STRING in form "<AttributeType>=<AttributeValue>[,<AttributeType>=<AttributeValue>]*" )

SUPPORTED with limitation according to the followings:

• AttributeValue case-sensitivity is supported as described in Section 4.3.

• Supported characters in AttributeValue are listed in Section 6.

scope = { baseObject(0), singleLevel(1), wholeSubtree(2) }

SUPPORTED

derefAliases = { neverDerefAliases(0), derefInSearching(1), derefFindingBaseObj(2), derefAlways(3) }

NOT SUPPORTED

sizeLimit = INTEGER (0 .. 2147483647)

SUPPORTED

This parameter specifies the client side limit for the operation, however the effective limit is the minimum of the number of entries specified in the following parameters:

• On client side, the sizelimit parameter of the search request. The value range of the parameter is 0–2147483647 in number of entries. Unspecified value means 0, by default, which means limit of infinite entries, thus no limit is enforced.

• On server side, the sizelimit parameter in the ldapServerId=provisioning MO. Its values can be "unlimited"; -1; and 1–2147483647 in number of entries. The default value if the parameter is not defined is 500. The server side size limit parameter can be reached through SNMP as well, as defined in Ericsson OpenLDAP MIB, Reference [6].

timeLimit = INTEGER (0 .. 2147483647)

SUPPORTED

This parameter specifies the client side limit for the operation, however the effective limit is the minimum of the time specified in the following parameters:

• On client side, the timelimit parameter of the search request. The value range of the parameter is 0–2147483647 in seconds. Unspecified value means 0, by default, which means limit of infinite time, thus no limit is enforced.

• On server side, the jimbeReceivingTimeLimit parameter in the ldapServerId=provisioning MO. Its values can be "unlimited"; -1; and 1–2147483647 in seconds. The default value if the parameter is not defined is 3600 s. The server side time limit parameter can be reached through SNMP as well, as defined in Ericsson OpenLDAP MIB, Reference [6].

typesOnly = BOOLEAN

NOT SUPPORTED

The typesOnly parameter is ignored, and both attribute types and attribute values are returned regardless of the setting or presence of typesOnly parameter.

filter / equalityMatch / attributeDesc = AttributeDescription

filter / substrings[] = SubstringFilter / type[] (AttributeDescription)

filter / greaterOrEqual = AttributeValueAssertion / attributeDesc[] (AttributeDescription)

filter / lessOrEqual = AttributeValueAssertion / attributeDesc[] (AttributeDescription)

filter / approxMatch = AttributeValueAssertion / attributeDesc[] (AttributeDescription)

filter / present = AttributeDescription

SUPPORTED with limitations according to the followings:

• Options are not supported.

• As a limitation, approxMatch is treated the same way as equalityMatch.

filter / equalityMatch / assertionValue = AssertionValue (OCTET STRING)

filter / greaterOrEqual = AttributeValueAssertion / assertionValue[] (AssertionValue)

filter / lessOrEqual = AttributeValueAssertion / assertionValue[] (AssertionValue)

filter / approxMatch = AttributeValueAssertion / assertionValue[] (AssertionValue)

SUPPORTED with limitation:

• AttributeValue case-sensitivity is supported as described in Section 4.3.

• Supported characters in AttributeValue are listed in Section 6.

filter / substrings[] = SubstringFilter / substrings[] = { initial; any; final }

SUPPORTED

filter / extensibleMatch

NOT SUPPORTED

attributes = AttributeDescriptionList / AttributeDescription[] (OCTET STRING)

SUPPORTED with limitation: Options are not supported.

Size of Search Result

The Search Result is described in section Search Result of RFC 2251 – Lightweight Directory Access Protocol (v3), Reference [3]. An LdapResult contains the matching attributes of an MO in string format.

Size of MO

The size of MOs can be limited by the implementation of the specific application.

Returning Operational Attributes

"Furthermore, servers will not return operational attributes, such as objectClasses or attributeTypes, unless they are listed by name, (...)"

If no specific attribute is requested, all attributes are returned. For vDicos LDAP, this includes the only supported operational attribute: objectClass. If a specific attribute is requested, only the requested attribute is returned.

Continuation References in the Search Result

vDicos LDAP does not support section Continuation References in the Search Result of RFC 2251 – Lightweight Directory Access Protocol (v3), Reference [3].

JavaJIM

In accordance with the RFC, in case of JavaJIM, only the deletion of leaf MOs is supported on the LDAP interface. Application designers can support recursive delete by implementing this function in classes derived from the Managed Object of JavaJIM.

Other (C++ JIM and CMF)

In case of C++ JIM and CMF, recursive deletion is implemented by the Managed Object of C++ JIM and CMF.

JavaJIM

In case of JavaJIM, the Compare operation is not supported on the LDAP interface.

Other (C++ JIM and CMF)

The Compare operation is supported on the LDAP interface in case of C++ JIM and CMF.

OperationsError

1

Operations Error

Indicates a transient database or backend-database connection problem, therefore, the operations must be retried.

TimeLimitExceeded

3

The Directory has reached the limit of time set by the user in a service control. No partial results are available to return to the user.

SizeLimitExceeded

4

Either the specified limit of the server or of the client on the number of search results was exceeded.

Compare False

5

Compare False

Compare True

6

Compare True

AuthMethodNotSupported

7

The server does not support the requested authentication method.

StrongAuthRequired

8

The server requires an authentication method stronger than unencrypted username and password.

AdminLimitExceeded

11

The number of objects involved in a recursive delete operation has exceeded the predefined limit.

NoSuchAttribute

16

The named entry lacks one of the attributes or attribute values specified as an argument of the operation.

The Managed Object lacks one of the specified attributes. The multivalued attribute lacks one of the specified values to be deleted.

UndefinedAttributeType

17

An undefined attribute type was provided as an argument to the operation. This error can occur only in relation to addEntry or ModifyEntry operations.

InappropriateMatching

18

An attempt was made, for example, in a filter, to use a matching rule not defined for the attribute type concerned.

ConstraintViolation

19

An attribute value supplied in the argument of an operation does not conform to the constraints imposed by ITU-T Rec. X.501 | ISO/IEC 9594-2, Reference [5], or by the attribute definition (for example, the value exceeds the maximum size allowed).

If the attribute value supplied in the argument of an operation does not conform to the special rules defined for that attribute. The attribute value can be out of the specified value range or string length.

For ENUMerated values an unknown value is invalid syntax.

Deletion of a single value attribute.

Attempt to set a read-only attribute.

Mandatory attributes are missing.

AttributeOrValueExists

20

An attempt was made to add an attribute that already existed in the entry, or a value that already existed in the attribute.

Try to add a value in a multi-valued attribute that already exists in the attribute.

InvalidAttributeSyntax

21

A purported attribute value, specified as an argument of the operation, does not conform to the attribute syntax of the attribute type.

The attribute value is a DN and the DN syntax is invalid.

For structured attributes, this response code is received in the following cases:

• One of the subfields consists of a DN and the DN syntax is faulty.

• Faulty separators.

• One of the subfields is missing.

• An alpha string is given as an attribute value when an integer is expected.

• The attribute does not have the specified value (used for ENUMerated values).

• The attribute objectClass is set to a value other than the object class name.

• Missing or zero length attribute value as the parameter of ldapadd or ldapmodify. Instead of creating an optional attribute with an empty string, simply omit the attribute. In this case, the default attribute value is set.

NoSuchObject

32

The name supplied does not match the name of any object.

The object pointed out by the DN does not exist.

If the DN syntax is invalid, see InvalidAttributeSyntax or InvalidDNSyntax. If the DN, given for an attribute, does not refer to an existing object, see ConstraintViolation.

InvalidDNSyntax

34

Invalid DN syntax.

The DN syntax of the named Managed Object is invalid.

Attributes where the attribute value is a DN and the DN syntax is invalid, see InvalidAttributeSyntax or ConstraintViolation.

InappropriateAuthentication

48

The level of security associated with the credentials of the requestor is inconsistent with the level of protection requested, for example, simple credentials were supplied while strong credentials were required.

InvalidCredentials

49

The supplied credentials were invalid.

InsufficientAccessRights

50

The requestor does not have the right to carry out the requested operation.

The administrator does not have the correct authorization to perform the operation.

Busy

51

Failed to execute the requested operation, but after a short while it can be executable if issued again.

The requested MO is locked, the Management Transaction is rolled back.

Unavailable

52

The Directory, or a part of it, is currently unavailable.

Database problem.

UnwillingToPerform

53

The Directory, or a part of it, is not prepared to execute this request, for example, because it leads to excessive consumption of resources or violates the policy of an Administrative Authority involved.

This result code is received in the following cases:

• Reading of configuration data has failed.

• DName is unknown (not registered).

• On the standby node of a NetRed system, when write or modify request has been sent that affects any NetShared objects.⁽¹⁾

LoopDetect

54

The Directory is unable to accomplish this request due to an internal loop.

NamingViolation

64

The attempted addition or modification could violate the structure rules of the MIB as defined in the Directory schema and ITU-T Rec. X.501 | ISO/IEC 9594-2, Reference [5]. That is, it could place an entry as the subordinate of an alias entry, or in a region of the MIB not permitted to a member of its object class, or could define an RDN for an entry to include a forbidden attribute type.

Creation of an object, but the parent of the object does not exist, or is not an allowed parent to the object.

ObjectClassViolation

65

The attempted update produces an entry inconsistent with the rules for entry content; for example, its object class definition, the MIB content rules, or with the definitions of ITU-T Rec. X.501 | ISO/IEC 9594-2 as they pertain to object classes.

NotAllowedOnNonLeaf

66

The attempted operation is only allowed on leaf entries.

For differences of C++ and Java, see Section 4.8.4.

NotAllowedOnRDN

67

The attempted operation affects the RDN (for example, the removal of an attribute that is part of the RDN).

EntryAlreadyExists

68

An attempted addEntry or modifyDN operation names an entry that already exists.

ObjectClassModsProhibited

69

An operation attempted to modify the structural object class of an entry.

Other

80

Internal limitation violation.

sizelimit

This parameter sets the upper limit for the number of database entries that an operation is allowed to return. If the operation exceeds this limit, it is abandoned internally and an error message is returned to the client.

Single value attribute

Integer or "unlimited" word

Value range:

• 1–2147483647

• –1 or "unlimited"

Default value: 500

The value –1 or "unlimited" implies no limit.

jimbeReceivingTimeLimit

This parameter sets the maximum duration of an operation. When the timelimit expires, the operation is abandoned internally and an error message is returned to the client.

This is specified in seconds.

Single value attribute

Integer or "unlimited" word

Value range:

• 1–2147483647

• –1 or "unlimited"

Default value: 15000000

The value –1 or "unlimited" implies no limit.

threads

This parameter sets the maximum size of the thread pool. Thus, it sets the maximum number of operations that can be performed at the same time in the LDAP server process.

Single value attribute

Unsigned integer

Default value: 16

host

The IP address of the LDAP server.

The usual IP address format: a.b.c.d or the string containing the hostname.

ipv6Host

The IPv6 address of the LDAP server.

The usual IPV6 address format.

port

The port number over which the LDAP server listens.

Unsigned 16 bit integer.

Make sure it does not conflict with other open ports on the host.

Default value: 17323

sslPort

The SSL port number over which the LDAP server listens.

Unsigned 16 bit integer.

Make sure it does not conflict with other open ports on the host.

Default value: 17423

dnSuffix

The DN suffix for the provisioning LDAP server.

String in the following format: "nodeName=<node_name>"

jimbeAccessControlList

The access control list for the provisioning server.

LDAP ACL entries starting with "to". Multi valued.

loglevel

The log level for the provisioning LDAP server.

Unsigned 8 bit integer. Default value: 0