LDAP V3 : Level of Support 
of an LDAP Server
Draft:		5
Date:		25.5.1998
From:		CEN/ISSS Directory Workshop
Author:		Annette Sündermann, Patrick Fantou,  Siemens Nixdorf AG
1	Scope
A lot of products on the market place are claiming support to LDAP V3, but it is for a procurer very difficult to know exactly what this really means. This is due to the fact that a big number of documents are associated with LDAP, and that every of these documents specifies mandatory features  but also optional ones, which are often not implemented. 
This document  gives the possibility to document which LDAP protocol elements and functionalities are supported by a product claiming to be an LDAP V3 Server.
It is based on the corresponding IETF documents. Each table is associated with one document and contains in every line the name of an element of the protocol or of a functionality specified in this document. The last column contains the information if the product supports this element or not:
Y : Element is supported
N : Element is not supported
Additionally these tables contains 4 other columns stating the level of support required in the LDAP profiles defined by The Open Group.
Product Name		
Release		
Vendor´s Name and Address		
2	IETF Documents
The IETF documents associated with LDAP can be classified in 3 groups, the core documents, the extensions documents and the associated documents. (See LDAP V3 References,  6, which contains the titles of all documents )
•	The core documents are the following RFCs :
•	RFC 2251 : Lightweight Directory Access protocol (v3)
-	RFC 2252 : Lightweight Directory Access Protocol (v3) : Attribute Syntax Definitions
-	RFC 2253 : Lightweigth Directory Access Protocol (v3) : UTF-8 String Representation of Distinguished Names
-	RFC 2254 : The String Representation of LDAP Search Filters
-	RFC 2255 : The LDAP URL Format
-	RFC 2256 : A Summary of the X.500(96) User Schema for use with LDAPv3
•	The extensions documents have draft status and are being considered work items of the IETF working group LDAPEXT. The topics are Sorting of Search results, dynamic directories, referral maintenance, language support , secured transport, authentication and access control.
-	draft-ietf-asid-ldapv3-simple-paged-02.txt
-	draft-ietf-ldapext-sorting-00.txt
-	draft-ietf-asid-ldapv3-dynamic-07.txt
-	draft-ietf-asid-ldapv3-dynatt-01.txt
-	draft-ietf-ladpext-referral-00.txt
-	draft-ietf-ldapext-lang-00.txt
-	draft-ietf-ldapext-ldapv3-tls-00.txt
-	draft-ietf-ldapext-ldapv3-vlv-01.txt
-	draft-ietf-ldapext-acl-reqst-00.txt
-	draft-ietf-ldapext-acl-model-00.txt
-	draft-ietf-ldapext-signops-00.txt
-	draft-ietf-ldapext-psearch-00.txt
-	draft-ietf-ldapext-authmeth-01.txt
-	draft-ietf-ldapext-ldapv3-txn-00.txt
•	The associated documents are also drafts (except domains-02) and are all other documents which relate to LDAP V3. These are for instance all documents concerning LDAP replication or synchronisation , topics of the LDUF BOF group ,or specific schema extensions and interchange format definitions which are more the topics of the LSD working group. 
(Note that there is no official assignement to the groups of documents ”extensions” or ”associated” )
-	draft-good-ldap-changelog-00.txt
-	draft-weiser-replica-req-01.txt
-	draft-ietf-asid-ldap-mult-mast-rep-02.txt
-	draft-ietf-asid-ldap-repl-info-01.txt
-	draft-ietf-asid-ldap-domains-02.txt (approved Proposed Standard)
-	draft-smith-ldap-inetorgperson-00.txt
-	draft-ietf-asid-ldap-rpcschema-00.txt
-	draft-ietf-asid-schema-pilot-00.txt
-	draft-ietf-asid-nis-schema-01.txt
-	draft-good-ldap-ldif-01.txt
-	draft-ietf-lsd-ldapv3-wp-00.txt
3	LDAP V3  Profiles from The Open Group
The Open Group has been defining LDAP V3 profiles, which will be used within the LDAP V3 testsuites of the Open Group for the planned branding . These now have the status of  Base Documents, but are not yet Final Documents. They are here presented with their actual requirements:
RO : 	Read -Only LDAP Server (based only on core documents)
RW: 	Read-Write LDAP server (core documents + referral + tls)
CERT : 	Certification Application Profile (RW requirements + pkix-ipkiopp)
WP:	White Pages Application Profile (CERT requirements + LIPS)
SSO:	Single Sign On Application LDAP Profile  (very high level requirements)
4	Support of the LDAP V3 Core documents
Global statement of support of the core documents:
Document	Supported?	
RFC 2251		
RFC 2252		
RFC 2253		
RFC 2254		
RFC 2255		
RFC 2256		
4.1	RFC 2251
Protocol element : 
Requests and Responses	Support required in RO Profile	Support required in RW Profile	Support required in CERT Profile	Support required in WP profile	Supported	
LDAP Message						
messageID	M	M	M	M		
protocolOp	M	M	M	M		
bindRequest/Response	M	M	M	M		
unbindRequest	M	M	M	M		
searchRequest	M	M	M	M		
searchResEntry	M	M	M	M		
searchResDone	M	M	M	M		
searchResRef	O
Not allowed in V2 session	M
Not allowed in V2 session	M
Not allowed in V2 session	M
Not allowed in V2 session		
modifyRequest/Response	-	M	M	M		
AddRequest/Response	-	M	M	M		
delRequest/Response	-	M	M	M		
modDNRequest/Response	-	O	O	O		
compareRequest/Response	M	M	M	M		
abandonRequest	M	M	M	M		
extendedReq						
extendedResp						
controls						

String types	Required support in all profiles	Supported?	
UTF-8	M
Not allowed in V2		
T.61	Only allowed in V2		

Restrictions or additional support for string handling:

Please write here
•	Which type of string the server sends during a V2 Session
•	How the server handles T.61 characters
•	If the server performs any string conversion, and if this functionality is configurable

Attribute description/options	RO profile	RW profile	CERT profile	WP profile	Supported?	
binary	O	O	M	M		
binary supported in AttributeList	O	O	M	M		
binary supported in AttributeAssertion	O	O	M	M		

LDAPResult	RO profile	RW profile	CERT profile	WP profile	Supported?	
resultCode						
Success (0)	M	M	M	M		
OperationsError (1)	M	M	M	M		
ProtocolError (2)	M	M	M	M		
TimeLimitExceeded (3)						
SizeLimitExceeded (4)	M	M	M	M		
CompareFalse (5)	M	M	M	M		
CompareTrue (6)	M	M	M	M		
AuthMethodNotSupported (7)	M	M	M	M		
StrongAuthRequired (8)	-					
Referral (10)	M	M	M	M		
AdminLimitExceeded (11)						
UnavailableCriticalExtension (12)						
ConfidentialityRequired (13)	-					
SaslBindInProgress (14)	-	M	O	M		
AttributeProblems (16-21)	M	M	M	M		
NameProblems (32-36)	M	M	M	M		
SecurityProblems (48-50)	M	M	M	M		
ServiceProblems (51-54)	M	M	M	M		
UpdateProblems (64-69)	M	M	M	M		
AffectMultipleDSAs (71)						
Other (80)						
matchedDN						
errorMessage	O					
Referral	O					
LDAPURL	O					

Controls	RO profile	RW profile	CERT profile	WP profile	Supported?	
Control						
controlType						
criticality		M	M	M		
controlValue						
request types:						
pagedResults <1.2.840.113556.1.4.319>						
sorting
<1.2.840.113556.1.4.473>						
manageDsaIT
<2.16.840.1.113730.3.4.2>		M	M	M		
PreferredLanguage
<1.3.6.1.4.1.1466.20035>						
unknown critical control type						
inappropriate critical control type						
unknown non-critical control type						
inappropriate non-critical control type						
response types:						
pagedResults <1.2.840.113556.1.4.319>						
sorting
<1.2.840.113556.1.4.474>						

BindRequest	RO profile	RW profile	CERT profile	WP profile	Supported?	
version	M	M	M	M		
name	M	M	M	M		
Authentication	M	M	M	M		
Simple	M		M			
Sasl	O	M				
mechanism		M
Note 1				
credentials						
						
Multiple bind requests on a connection	M	M	M	M		

Note 1 : Mechanisms CRAM-MD5 and EXTERNAL (TLS) mandatory

BindResponse	RO
profile	RW
profile	CERT
profile	WP
profile	Supported?	
LDAPResult	M	M	M	M		
serverSaslCreds		M	O	M		

Unsolicited Notification	Required support in documents	Supported?	
Notice of Disconnection	O		
protocolError	O		
strongAuthRequired	O		
unavailable	O		

SearchRequest	RO profile	RW profile	CERT profile	WP profile	Supported?	
baseObject	M	M	M	M		
scope	M	M	M	M		
BaseOject	M	M	M	M		
SingleLevel	M	M	M	M		
wholeSubtree	M	M	M	M		
derefAliases						
neverDerefAliases						
derefInSearching						
derefFindingBaseObj						
derefAlways						
sizeLimit						
timeLimit						
typesOnly						
filter	M	M	M	M		
and	M	M	M	M		
or	M	M	M	M		
not	M	M	M	M		
equalityMatch	M	M	M	M		
Substrings (substringFilter)	M	M	M	M		
type	M	M	M	M		
substrings	M	M	M	M		
initial	M	M	M	M		
any	M	M	M	M		
final	M	M	M	M		
greaterOrEqual	M	M	M	M		
lessOrEqual	M	M	M	M		
present	M	M	M	M		
approxMatch	M	M	M	M		
extensibleMatch	M	M	M	M		
attributes	M	M	M	M		
empty list						
"*" attribute description						
"1.1" attribute description						
						
MatchingRuleAssertion	M	M	M	M		
matchingRule	M	M	M	M		
type	M	M	M	M		
matchValue	M	M	M	M		
dnAttributes	M	M	M	M		

SearchResult	RO profile	RW profile	CERT profile	WP profile	Supported?	
SearchResultEntry	M	M	M	M		
objectName	M	M	M	M		
attributes	M	M	M	M		
PartialAttributeList	M	M	M	M		
type	M	M	M	M		
vals	M	M	M	M		
						
SearchResultReference	O	M	M	M		
SEQ OF LDAPURL	O	M	M	M		
						
SearchResultDone	M	M	M	M		

Modify	RO profile	RW profile	CERT profile	WP profile	Supported?	
ModifyRequest						
object		M	M	M		
modification		M	M	M		
operation		M	M	M		
add		M	M	M		
delete		M	M	M		
replace		M	M	M		
modification		M	M	M		
						
ModifyResponse		M	M	M		

Add	RO profile	RW profile	CERT profile	WP profile	Supported?	
AddRequest		M	M	M		
entry		M	M	M		
Attributes		M	M	M		
AttributeList		M	M	M		
type		M	M	M		
vals		M	M	M		
AddResponse		M	M	M		

Delete	RO profile	RW profile	CERT profile	WP profile	Supported?	
DelRequest	M	M	M	M		
LDAPDN		M	M	M		
						
DelResponse		M	M	M		

ModifyDN	RO profile	RW profile	CERT profile	WP profile	Supported?	
ModifyDNRequest		O	O	O		
entry						
newdn						
deleteoldrdn						
newsuperior						
						
ModifyDNResponse						
LDAPResult						

Compare	RO profile	RW profile	CERT profile	WP profile	Supported?	
CompareRequest	M	M	M	M		
entry	M	M	M	M		
ava	M	M	M	M		
						
CompareResponse						
LDAPResult	M	M	M	M		

Abandon	RO profile	RW profile	CERT profile	WP profile	Supported?	
AbandonRequest	M	M	M	M		
MessageID	M	M	M	M		

Extended Operation	RO profile	RW profile	CERT profile	WP profile	Supported?	
ExtendedRequest						
requestName						
requestValue						
ExtendedResponse						
responseName						
response						
standardResponse						
request names:						
Unsolicited Notification:
Notice of Disconnection
<1.3.6.1.4.1.1466.20036>						
result Codes:						
protocolError						
strongAuthRequired						
unavailable						
refresh
<1.3.6.1.4.1.1466.101.119.1>						
tls <1.3.6.1.4.1.1466.20037>						
response names:						
refresh
<1.3.6.1.4.1.1466.101.119.1>						
tls <1.3.6.1.4.1.1466.20037>						

4.2	RFC 2252
4.2.1	Operational attributes
Root DSE	RO profile	RW profile	CERT profile	WP profile	Supported?	
namingContexts	M	M	M	M		
subSchemaSubentry	M	M	M	M		
altServer						
supportedExtension		M	M	M		
supportedControl		M	M	M		
SupportedSASLMechanisms						
supportedLDAPVersion	M	M	M	M		

Subschema entry	RO profile	RW profile	CERT profile	WP profile	Supported?	
ldapSyntaxes						
objectClasses	M	M	M	M		
attributeTypes	M	M	M	M		
matchingRules						
matchingRuleUse						
nameForms						
ditStructureRules						
ditContentRules						
createTimeStamp		M	M	M		
modifyTimeStamp		M	M	M		

Entry	RO profile	RW profile	CERT profile	WP profile	Supported?	
createTimeStamp		M	M	M		
modifyTimeStamp		M	M	M		
creatorsName		M	M	M		
modifiersName		M	M	M		
subschemaSubentry	M	M	M	M		

4.2.2	Syntaxes
	Syntaxes	RO profile	RW profile	CERT profile	WP profile	Support for Read Operations	Support for Modify Operations	
1	ACI Item 1)							
2	Access Point							
3	Attribute Type Description							
4	Audio 1)							
5	Binary 1)		O	M	M			
6	Bit String							
7	Boolean							
8	Certificate 1)		O	M	M			
9	Certificate List 1)		O	M	M			
10	Certificate Pair 1)		O	M	M			
11	Country String	M	M	M	M			
12	DN	M	M	M	M			
13	Data Quality Syntax							
14	Delivery Method			M	M			
15	Directory String	M	M	M	M			
16	DIT Content Rule Description							
17	DIT Structure Rule Description							
18	DL Submit Permission							
19	DSA Quality Syntax							
20	DSE Type							
21	Enhanced Guide							
22	Facsimile Telephone Number	M	M	M	M			
23	Fax 1)							
24	Generalized Time							
25	Guide			M	M			
26	IA5 String							
27	Integer							
28	JPEG 1)							
29	Master And Shadow Access Point							
30	Matching Rule Description							
31	Matching Rule Use Description							
32	Mail Preference							
33	MHS OR Address							
34	Name and Optional UID							
35	Name Form Description							
36	Numeric String	M	M	M	M			
37	Object Class Description							
38	OID							
39	Other Mailbox							
40	Octet String		M	M	M			
41	Postal Address	M	M	M	M			
42	Protocol Information							
43	Presentation Address							
44	Printable String	M	M	M	M			
45	Subtree Specification							
46	Supplier Information							
47	Supplier Or Consumer							
48	Supplier And Consumer							
49	Supported Algorithm 1)		M	M	M			
50	Telephone Number	M	M	M	M			
51	Teletex Terminal Identifier			M	M			
52	Telex Number			M	M			
53	UTC Time							
54	LDAP Syntax Description							
55	Modify Rights							
56	LDAP Schema Definition							
57	LDAP Schema Description							
58	Substring Assertion							
1) Attribute values of this syntax are always transferred in binary representation with the ";binary" option set

4.2.3	Object Classes
Object Classes	RO profile	RW profile	CERT profile	WP profile	Supported?	
Extensible Object class						
subschema	M	M	M	M		

4.2.4	Matching Rules
Matching Rules	RO profile	RW profile	CERT profile	WP profile	Supported?	
objectIdentifierMatch						
distinguishedNameMatch	M	M	M	M		
caseIgnoreMatch	M	M	M	M		
numericStringMatch	M	M	M	M		
caseIgnoreListMatch	M	M	M	M		
integerMatch						
bitStringMatch						
telephoneNumberMatch	M	M	M	M		
presentationAddressMatch						
uniqueMemberMatch						
protocolInformationMatch						
generalisedTimeMatch	M	M	M	M		
caseExactIA5Match						
caseIgnoreIA5Match						
						
generalisedTimeOrderingMatch	M	M	M	M		
caseIgnoreOrderingMatch	M	M	M	M		
						
caseIgnoreSubstringMatch	M	M	M	M		
telephoneNumberSubstringMatch	M	M	M	M		
numeringStringSubstringMatch	M	M	M	M		
						
integerFirstComponentMatch						
objectIdentifierFirstComponentMatch						

4.3	RFC 2253
The following features are supported when returning an LDAPDN to the client:
Converting DN from ASN.1 To a String	RO profile	RW profile	CERT profile	WP profile	Supported?	
Multiple RDN	M	M	M	M		
Multi-valued RDN (+)	M	M	M	M		
						
AttributeType						
string representation						
dotted decimal notation						
						
Attribute Value						
String						
Escaped leading spaces						
Escaped trailing spaces						
Escaped ",","+",""","\","<",">",";"						
Escaped leading "#"						
Other escaped characters:
(List here)						
Hexstring (#*)						

The following features are supported when parsing an LDAP DN received from the client:
Parsing String to DN	RO profile	RW profile	CERT profile	WP profile	Supported?	
Support for LDAP V3 DNs:						
attributeType						
string notation	M	M	M	M		
dotted decimal notation	M	M	M	M		
						
attributeValue						
string notation						
escaped ",","=","+","<",">",""#",";"	M	M	M	M		
escaped "\"	M	M	M	M		
escaped """	M	M	M	M		
escaped hexpair	M	M	M	M		
other escaped characters	M	M	M	M		
Hexstring (#*)	M	M	M	M		
Quotation						
escaped ",","=","+","<",">",""#",";"	M	M	M	M		
escaped "\"	M	M	M	M		
escaped """	M	M	M	M		
escaped hexpair	M	M	M	M		
other escaped characters	M	M	M	M		
						
Support RFC1779 LDAP DNs						
RDNs						
";" as separator for RDNs						
ignore whitespaces before separators "+", "," and ";"						
ignore whitespaces after separators "+", "," and ";"						
attributeType						
"oid." + dotted decimal						
"OID." + dotted decimal						
ignore trailing whitespaces						
attributeValue						
ignore leading whitespaces						

4.4	RFC 2254

String Search Filter elements	RO profile	RW profile	CERT profile	WP profile	Supported?	
Filter	M	M	M	M		
and						
or						
not						
equalityMatch	M	M	M	M		
substrings	M	M	M	M		
greaterOrEqual	M	M	M	M		
lessOrEqual	M	M	M	M		
present						
approxMatch	M	M	M	M		
extensibleMatch		M	M	M		
						
SubstringFilter	M	M	M	M		
type	M	M	M	M		
substrings	M	M	M	M		
initial	M	M	M	M		
any	M	M	M	M		
final	M	M	M	M		
						
MatchingRuleAssertion		M	M	M		
matchingRule		M	M	M		
type		M	M	M		
matchValue						
dnAttributes						

4.5	RFC 2255
Creation of a LDAP URL by the server	RO profile	RW profile	CERT profile	WP profile	Supported?	
ldapurl 	M	M	M	M		
hostport	M	M	M	M		
dn	M	M	M	M		
attributes						
scope						
filter						
extensions		M	M	M		

4.6	RFC 2256
User attributes	RO profile	RW profile	CERT profile	WP profile	Supported?	
objectClass	M	M	M	M		
aliasedObjectName						
knowledgeInformation						
cn			M	M		
sn			M	M		
serialNumber						
c	M	M	M	M		
l			M	M		
st			M	M		
street			M	M		
o			M	M		
ou			M	M		
title			M	M		
description			M	M		
searchGuide			M	M		
businessCategory			M	M		
postalAddress	M	M	M	M		
postalCode			M	M		
postOfficeBox			M	M		
physicalDeliveryOfficeName			M	M		
telephoneNumber	M	M	M	M		
telexNumber			M	M		
teletexTerminalIdentifier			M	M		
facsimileTelephoneNumber	M	M	M	M		
X121Adress			M	M		
internationalISDNNUmber			M	M		
registeredAddress			M	M		
destinationIndicator			M	M		
preferredDeliveryMethod						
presentationAddress						
supportedApplicationContext						
member						
owner						
roleOccupant						
seeAlso			M	M		
userPassword			M	M		
userCertificate		O	M	M		
cACertificate		O	M	M		
authorityRevocationList		O	M	M		
certificateRevocationList		O	M	M		
crossCertificatePair		O	M	M		
name			M	M		
givenName			M	M		
initials			M	M		
generationQualifier			M	M		
X500UniqueIdentifier						
dnQualifier						
enhancedSearchGuide						
protocolInformation						
distinguishedName			M	M		
uniqueMember						
houseIdentifier						
supportedAlgorithms		M	M	M		
deltaRevocationList			M	M		
dmdName						

Syntaxes	RO profile	RW profile	CERT profile	WP profile	Support for Read Operations	Support for Modify Operations	
Delivery method			M	M			
Enhanced Guide							
Guide			M	M			
Octet String							
Teletex Terminal Identifier			M	M			
Telex Number			M	M			
Supported Algorithm 		M	M	M			

Object Classes	RO profile	RW profile	CERT profile	WP profile	Supported?	
top			M	M		
alias						
country			M	M		
locality			M	M		
organization			M	M		
organizationalUnit			M	M		
person			M	M		
organizationalPerson			M	M		
organizationalRole						
groupOfNames						
residentialPerson			M	M		
applicationProcess						
applicationEntity						
dSA						
device						
strongAuthenticationUser						
certificationAuthority			M	M		
groupOfUniqueNames						
userSecurityInformation						
certificationAuthority-V2			M	M		
cRLDistributionPoint			M	M		
dmd						

Matching Rules	RO profile	RW profile	CERT profile	WP profile	Supported?	
octetStringMatch			M	M		
5	Support of the LDAP V3 Extensions documents
5.1	Global statement of support for the LDAP Extensions
Document	Supported?	
LDAP Control Extension for Simple Paged Results Manipulation
<<draft-ietf-asid-ldapv3-simple-paged-02.txt>>		
LDAP Control Extension for Server Side Sorting of Search Results
<<draft-ietf-ldapext-sorting-00.txt>>		
LDAP(v.3): Extensions for Dynamic Directory Services
<<draft-ietf-asid-ldapv3-dynamic-07.txt>>		
Lightweight Directory Access Protocol: Dynamic Attributes
<<draft-ietf-asid-ldap-dynatt-01.txt>>		
Referrals and Knowledge References in LDAP Directories:
<<draft-ietf-ldapext-referral-00.txt>>		
Use of Language Codes in LDAPv3
<<draft-ietf-ldapext-lang-00.txt>>		
LDAP(v.3): Extension for Transport Layer Security
<<draft-ietf-ldapext-ldapv3-tls-00.txt>>		
LDAP Extensions for Scrolling View Browsing of Search Results
<<draft-ietf-ldapext-ldapv3-vlv-01.txt>>		
Access Control Requirements for LDAP 
<<draft-ietf-ldapext-acl-reqts-00.txt>>		
Access Control Model for LDAP 
<<draft-ietf-ldapext-acl-model-00.txt>>		
Signed Directory Operations using S/MIME 
<<draft-ietf-ldapext-signops-00.txt>>		
Persistent Search : a simple LDAP Change Notification Mechanism
<<draft-ietf-ldapext-psearch -00.txt>>		
Authentication Methods for LDAP 
<<draft-ietf-ldapext-authmeth-01.txt>>		
LDAP extensions for simple transactions
<<draft-ietf-ldapext-ldapv3-txn-00.txt>>		
5.2	LDAP Control Extension for Simple Paged Results Manipulation
Statement of support for the features defined in << draft-ietf-asid-ldapv3-simple-paged-02.txt >>:
5.2.1	The pagedResults Control
Control	RO profile	RW profile	CERT profile	WP profile	Supported?	
pagedResults Control						
type <1.2.840.113556.1.4.319>						
criticality						
FALSE1)						
TRUE2)						
controlValue searchControlValue						
realSearchControlValue						
size						
cookie						
c1: if pagedResults are supported m else o
1) If the server does not support the pagedResults control and the client marks it as non-critical, the server should ignore the control and process the request as if it was absent.
2) If the server does not support the pagedResults control and the client marks it as critical, the server must indicate an error indicating an unavailable critical extension. No results shall be returned.
5.3	LDAP Control Extension for Server Side Sorting of Search Results
5.3.1	Controls
Control	RO profile	RW profile	CERT profile	WP profile	Supported?	
request Control						
type <1.2.840.113556.1.4.473>						
criticality						
FALSE1)						
TRUE2)						
controlValue						
sortKeyList						
type						
orderingRule						
reverseOrder						
response Control						
type <1.2.840.113556.1.4.474>						
criticality						
controlValue						
sortResult						
sortResult						
(0) success						
(1) operationsError						
(3) timeLimitExceeded						
(8) strongAuthRequired						
(11) adminLimitExceeded						
(16) noSuchAttribute						
(18) inappropriateMatching						
(50) insufficientAccessRights						
(51) busy						
(53) unwillingToPerform						
(89) other						
attributeType						
c1: if sortedResults are supported m else o
1)	If the server does not support the sorting control and the client marks it as non-critical, the server must ignore the control and process the request as if it was absent.
2)	If the server does not support the sorting control and the client marks it as critical, the server must indicate an error indicating an unavailable critical extension. No results shall be returned.
5.4	Dynamic attributes
5.4.1	Attribute options
Specify if the ";dynamic" option is recognized by the LDAP Server in an attribute description:
Option	RO profile	RW profile	CERT profile	WP profile	Supported?	
dynamic1)						
1) If dynamic attributes are not supported, the server may return a suitable error.
Specify the LDAP error the LDAP Server returns on receipt of the ";dynamic" option in an attributeDescription if dynamic attributes are not supported:

5.4.2	Object Classes
Object Class	RO profile	RW profile	CERT profile	WP profile	Supported?	
dynamicObject
1.3.6.1.4.1.1466.101.119.2						
5.4.3	Attribute types
Attribute type	RO profile	RW profile	CERT profile	WP profile	Supported?	
entryTtl
1.3.6.1.4.1.1466.101.119.3						
dynamicSubtrees
1.3.6.1.4.1.1466.101.119.4						
5.4.4	Extended Operations
Extended Operation	RO profile	RW profile	CERT profile	WP profile	Supported?	
ExtendedRequest						
requestName
<1.3.6.1.4.1.1466.101.119.1>						
requestValue						
SEQUENCE						
entryName						
requestTtl						
ExtendedResponse						
responseName
<1.3.6.1.4.1.1466.101.119.1>						
response						
standardResponse						
SEQUENCE						
responseTtl						

5.5	Referrals and Knowledge References in LDAP Directories
Statement of support for the features defined in <<draft-ietf-asid-ldapv3-referral-00.txt>>:
5.5.1	Object Classes
Object Class	RO profile	RW profile	CERT profile	WP profile	Supported?	
referral
2.16.840.1.113730.3.2.6		M	M	M		
5.5.2	Attribute types
Attribute type	RO profile	RW profile	CERT profile	WP profile	Supported?	
ref
2.16.840.1.113730.3.1.34		M	M	M		
5.5.3	The manageDsaIT Control
Control	RO profile	RW profile	CERT profile	WP profile	Supported?	
manageDsaIT Control		M	M	M		
type <2.16.840.1.113730.3.4.2>						
criticality TRUE						
controlValue <omit>	-					

5.6	Use of Language Codes in LDAPv3
Statement of support for the features defined in <<draft-ietf-ldapext-lang-00.txt>>:
5.6.1	Language codes supported
List the language codes supported by the LDAP Server:
Language code	Support in Search Filter	Support in Search Selection	Support in Compare AVA	Support in Add	Support in Modify	

Specify the LDAP error the LDAP Server returns on receipt of an unknown language code in an attributeDescription:

Specify the LDAP error the LDAP Server returns on receipt of a language code in a DN or RDN:

5.6.2	Preferred Language Control
Control	RO profile	RW profile	CERT profile	WP profile	Supported?	
PreferredLanguageControl						
type <1.3.6.1.4.1.1466.20035>						
criticality FALSE						
controlValue 
<language-code from RFC1766>						
5.7	Extension for Transport Layer Security
5.7.1	Extended Operations
Extended Operation	RO profile	RW profile	CERT profile	WP profile	Supported?	
ExtendedRequest						
RequestName : Start TLS
<1.3.6.1.4.1.1466.20037>		M	M	M		
requestValue						
ExtendedResponse						
responseName
<1.3.6.1.4.1.1466.20037>		M	M	M		
response						
standardResponse						

5.8	LDAP Extensions for Scrolling View Browsing of Search Results
5.8.1	Controls for Scrolling View Browsing
Control	RO profile	RW profile	CERT profile	WP profile	Supported?	
requestControl						
type <2.16.840.1.113730.3.4.9>						
criticality TRUE						
controlValue						
VirtualListViewRequest						
beforeCount						
afterCount						
CHOICE 						
byIndex						
index						
contentCount						
byValue						
responseControl						
type <2.16.840.1.113730.3.4.10>						
criticality						
controlValue						
VirtualListViewResponse						
targetPosition						
contentCount						
virtualListViewResult						
(0) success						
(1) operationsError						
(3) timeLiitExceeded						
(11) adminLimitExceeded						
(50) insufficientAccessRights						
(51) busy						
(53) unwillingToPerform						
(60) sortControlMissing						
(61) indexRangeError						
(80) other						

6	Support of the LDAP V3 Associated documents
6.1	Global statement of support for the LDAP acssociated documents
Document	Supported?	
Definition of an Object Class to hold LDAP Change Records
<<draft-good-ldap-changelog-00.txt>>		
LDAP replication requirements
<<draft-weiser-replica-req-00.txt>>		
LDAP Multi-master Replication Protocol
<<draft-ietf-asid-mult-mast-rep-02.txt>>		
Schema for Replication Information
<<draft-ietf-asid-repl-info-01.txt>>		
An Approach for using Domains in LDAP Distinguished Names 
<<draft-ietf-asid-ldap-domains-02.txt>>		
Definition of the InetOrgPerson ObjectClass 
<<draft-smith-ldap-inetorgperson-00.txt>>		
LDAP Schema for Storing RPC Entries in a Directory Service
<<draft-ietf-asid-ldap-rpcschema-00.txt>>		
A Summary of the Pilot X.500 Schema for use with LDAPv3 
<<draft-ietf-asid-schema-pilot-00.txt>>		
An Approach for using LDAP as a Network Information Service
<<draft-ietf-asid-nis-schema-00.txt>>		
The LDAP Data Interchange Format (LDIF) : Technical Specification
<<draft-good-ldap-ldif-00.txt>>		
A minimum LDAP v3 White Pages Schema
<<draft-ietf-lsd-ldapv3-wp-00.txt>>		

7	LDAP V3 References
This list of IETF documents reflects the status of the work at the middle of May 1998.
7.1	LDAP V3 Core Documents
These documents have been approved by the IESG as Proposed Internet Standards.
[711]	Lightweight Directory Access Protocol(v.3)
RFC 2251 December 1997
[712]	LDAP(v.3): Attribute Syntax Definitions
RFC 2252 December 1997
[713]	LDAP(v.3): UTF-8 String Representation of Distinguished Names
RFC 2253 December 1997
[714]	The String Representation of LDAP Search Filters
RFC 2254 December 1997
[715]	The LDAP URL Format
RFC 2255 December 1997
[716]	A Summary of the X.500(96) User Schema for use with LDAPv3
RFC 2256 December 1997
7.2	LDAPv3 Extension Documents
These documents are draft status and are being considered work items of the new LDAPEXT IETF working group.
[721]	LDAP Control Extension for Simple Paged Results Manipulation
<<draft-ietf-asid-ldapv3-simple-paged-02.txt>> , February 1998
[722]	LDAP Control Extension for Server Side Sorting of Search Results
<<draft-ietf-ldapext-sorting-00.txt>>, 10 March, 1998
[723]	LDAP(v.3): Extensions for Dynamic Directory Services
<<draft-ietf-asid-ldapv3-dynamic-07.txt>>,  15 December 1997
[724]	Lightweight Directory Access Protocol: Dynamic Attributes
<<draft-ietf-asid-ldap-dynatt-01.txt>>, 20 November 1997
[725]	Referrals and Knowledge References in LDAP Directories
<<draft-ietf-ldapext-referral-00.txt>> , 13 March, 1998
[726]	Use of Language Codes in LDAPv3
<<draft-ietf-ldapext-lang-00.txt>>, 13  January 1998
[727]	LDAP(v.3): Extension for Transport Layer Security
<<draft-ietf-ldapext-ldapv3-tls-00.txt>>, March 1998
[728]	LDAP Extensions for Scrolling View Browsing of Search Results
<<draft-ietf-ldapext -ldapv3-vlv-01.txt>>, 16 March 1998
[729]	 Access Control Requirements for LDAP 
<<draft-ietf-ldapext-acl-reqts-00.txt>>, 16 February, 1998
[7210]	 Access Control Model for LDAP 
<<draft-ietf-ldapext-acl-model-00.txt>>, 27 March, 1998
[7211] Signed Directory Operations using S/MIME 
<<draft-ietf-ldapext-signops-00.txt>>, 20 May, 1998
[7212] 	Persistent Search : a simple LDAP Change Notification Mechanism
<<draft-ietf-ldapext-psearch-00.txt>>, 16 February, 1998
[7213]	 Authentication Methods for LDAP 
<<draft-ietf-ldapext-authmeth-01.txt>>, 28 January, 1998
[7214]	 LDAP extensions for simple transactions
<<draft-ietf-ldapext-ldapv3-txn-00.txt>>, April, 1998
7.3	Associated LDAPv3 Documents
These documents also are draft status (except [735]) and have yet to be allocated to specific IETF working groups. The documents handling LDAP replication or synchronisation should become work item of a not yet approved LDUP working group.
[731]	Definition of an Object Class to Hold LDAP Change Records
<<draft-good-ldap-changelog-00.txt>>, 11 March ,1998
[732]	LDAP replication requirements
<<draft-weiser-replica-req-01.txt>>, 13 April, 1998
[733]	LDAP Multi-master Replication Protocol
<<draft-ietf-asid-ldap-mult-mast-rep-02 >> November 1997
[734]	Schema for Replication Information
<<draft-ietf-asid-repl-info-01.txt>>, July 1997
[735]	An Approach for using Domains in LDAP Distinguished Names
<<draft-ietf-asid-ldap-domains-02.txt>>
(approved as Proposed Standard on december 1997, the 29th   )
[736]	Definition of the inetOrgPerson Object Class
<<draft-smith-ldap-inetorgperson-00.txt>>, 13 March, 1998
[737]	LDAP Schema for Storing RPC Entries in a Directory Service
<<draft-ietf-asid-ldap-rpcschema-00.txt>>, 28 February 1997
[738]	A Summary of the Pilot X.500 Schema for use with LDAPv3
<<draft-ietf-asid-schema-pilot-00.txt>>, 24 March 1997
 [739]	An Approach for using LDAP as a Network Information Service
<<draft-ietf-asid-nis-schema-01.txt>>,18 November 1997
[7310] 	The LDAP Data Interchange Format (LDIF) - Technical Specification
<<draft-good-ldap-ldif-00.txt>>, 11 March 1998
[7311]	 A Minimum LDAPv3 White Pages Schema 
<<draft-ietf-lsd-ldapv3-wp-00.txt>>, 28 January, 1998

8	References to the LDAP V3 profiles
The LDAP Profile Base Documents can be found  at http://www.critical-angle.com/test/profile

[81]	Read-Only LDAP Server Profile Definition , 16 January 1998

[82]	Read-Write LDAP Server Profile Definition , 16 January 1998

[83]	Certificate Application LDAP Server Profile Definition, 6 January 1998

[84]	White Pages Application Server Profile Definition , 6 January 1998

[85]	Single Sign On Application LDAP Server Profile Definition , 6 January 1998