RFC 3673 (rfc3673) - Page 2 of 5
Lightweight Directory Access Protocol version 3 (LDAPv3): All Operational Attributes
Alternative Format: Original Text Document
RFC 3673 LDAPv3: All Operational Attributes December 2003
2. All Operational Attributes
The presence of the attribute description "+" (ASCII 43) in the list
of attributes in a Search Request [RFC 2251] SHALL signify a request
for the return of all operational attributes.
As with all search requests, client implementors should note that
results may not include all requested attributes due to access
controls or other restrictions. Client implementors should also note
that certain operational attributes may be returned only if requested
by name even when "+" is present. This is because some operational
attributes are very expensive to return.
Servers supporting this feature SHOULD publish the Object Identifier
1.3.6.1.4.1.4203.1.5.1 as a value of the 'supportedFeatures'
[RFC 3674] attribute in the root DSE.
3. Interoperability Considerations
This mechanism is specifically designed to allow users to request all
operational attributes using existing LDAP clients. In particular,
the mechanism is designed to be compatible with existing general
purpose LDAP clients including those supporting LDAP URLs [RFC 2255].
The addition of this mechanism to LDAP is not believed to cause any
significant interoperability issues (this has been confirmed through
testing). Servers which have yet to implement this specification
should ignore the "+" as an unrecognized attribute description per
[RFC 2251, Section 4.5.1]. From the client's perspective, a server
which does not return all operational attributes when "+" is
requested should be viewed as having other restrictions.
It is also noted that this mechanism is believed to require no
modification of existing LDAP APIs.
4. Security Considerations
This document provides a general mechanism which clients may use to
discover operational attributes. Prior to the introduction of this
mechanism, operational attributes were only returned when requested
by name. Some might have viewed this as obscurity feature. However,
this feature offers a false sense of security as the attributes were
still transferable.
Implementations SHOULD implement appropriate access controls
mechanisms to restricts access to operational attributes.
Zeilenga Standards Track