2.16.840.1.113730.3.4.18

Proxy Authorization

Allows an LDAP client application to bind to Oracle Internet Directory server with its own identity and then to perform operations on behalf of another user or on behalf of multiple users.

This control can improve performance especially for proxy operations performed on behalf of multiple users. The LDAP operation does not require a rebind for each user.

For example, consider this scenario:

• A client application named proxy-app binds to Oracle Internet Directory server.

• A user named John Doe sends a request to the proxy-app client application. The client must be a member of the proxy authorization group.

• Instead of passing the request to the Oracle Internet Directory server as proxy-app, the client passes the Proxy Authorization control along with the proxy DN (John Doe) to the server.

• The server performs the LDAP request for John Doe using John Doe's privileges (ACLs). The server can access only the information or perform only the operations that John Doe has privileges to access or perform.

Considerations for the Proxy Authorization control are:

• If the control is not accompanied by a proxy dn, the server throws an exception and returns an error to the client. If the criticality flag is not set to TRUE, the request is rejected with a protocol error.

• If the proxy user has the privileges to perform the operation as per the ACLs, the server executes the request; otherwise, the server returns the result code "123".

• Oracle Internet Directory server determines if a Proxy Authorization request is to be honored. Anonymous users are not allowed to assume the identity of others.

• If the server receives more than one Proxy Authorization control in the same operation, an error is returned to the client application and the operation attempt is unsuccessful.

1.3.6.1.4.1.42.2.27.8.5.1

Password Policy

Allows an LDAP client to request information from Oracle Internet Directory server about the current password policy state for a user. If a password policy is applicable, a client can send this control with these operations:

• ldapbind, ldapmodify, ldapadd, or ldapcompare

• ldapsearch

Other operations such as ldapunbind and ldapabandon are not supported. Also, this control does not apply to a replication bind.

The password policy request control does not have a controlValue, but the response control has return values, which are described in Table 3-3.

The password policy is typically applied to the single-valued attribute userPassword for the LDAP simple authentication method or password-based Simple Authentication and Security Layer (SASL) authentication.

For more information, see "Password Policy for LDAP Directories" at this location:

http://tools.ietf.org/html/draft-behera-ldap-password-policy-09

2.16.840.1.113730.3.4.3

Persistent Search

Allows an LDAP client to send a persistent search request to Oracle Internet Directory server.

A persistent search operation is an enhanced search that continues after the initial search results are returned by the server to the client. After the initial search is finished, the connection to the server is kept alive until the client unbinds or abandons the operation. The client can track changes for entries in the search scope and receive an Entry Change Notification response control if an entry is modified.

The definition for this control is:

PersistentSearch ::= SEQUENCE {
     controlType 2.16.840.1.113730.3.4.3
     changeTypes INTEGER,
     changesOnly BOOLEAN,
     returnECs BOOLEAN
}

For a description of these fields, see:

http://tools.ietf.org/id/draft-ietf-ldapext-psearch-03.txt

2.16.840.1.113894.1.8.39

Computed Attribute Value Uniqueness

Allows computed attribute value uniqueness for an entry-based combination of multiple attribute values. Usually, attribute uniqueness is configured only for a single attribute. An application that requires uniqueness for a combination of attribute values can send this control, and Oracle Internet Directory server ensures that the computed attribute value is unique across the directory during an operation such as ldapadd, ldapmodify -add, or ldapmodify -replace.

If an entry with the computed value already exists, Oracle Internet Directory server returns the LDAP error code: LDAP_ALREADY_EXISTS = 0x44.

For example, in a multi-tenant environment, the UID attribute of a user must be unique for a specific tenant but not necessarily unique across the directory. An application creates an LDAP entry with a computed attribute named TenantID_UID, where TenantID is the identifier of the tenant and UID is the attribute. The application that creates the LDAP entry sends this control, and if an entry with the computed attribute already value already exists, Oracle Internet Directory server returns the LDAP_ALREADY_EXISTS error code.

2.16.840.1.113730.3.4.9

OID_SEARCH_VLV_REQ_CONTROL

Allows a client to specify that the server return, for a given LDAP search, a contiguous subset of a large search result set. It can be used to go through the search results one page at a time, which allows a client to retrieve results more quickly and prevents the client from needing to store too many search results at a time.

The server returns the OID_SEARCH_VLV_RES_CONTROL 2.16.840.1.113730.3.4.10.

The OID_SEARCH_VLV_REQ_CONTROL works only in conjunction with the SORT control (ldapsearch -T argument). If you do not include a SORT control, the request returns LDAP error code 53 - Search operation with VLV request control is missing SORT request control.

The SORT control can contain any sort specification valid for the server. When the SORT control is used with the OID_SEARCH_VLV_REQ_CONTROL, the server does not return the complete set of sorted search results, but instead returns a contiguous subset of those entries specified in the control using a target entry as a reference point for results.

For more information, see "LDAP Extensions for Scrolling View Browsing of Search Results" at http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-09.

1.2.840.113556.1.4.319

OID_SEARCH_PAGING_CONTROL

See "Understanding Paged LDAP Search Results"

1.2.840.113556.1.4.473

OID_SEARCH_SORTING_REQUEST_CONTROL

See "Understanding Sorted LDAP Search Results"

2.16.840.1.113730.3.4.2

GSL_MANAGE_DSA_CONTROL

Used to manage referrals, dynamic groups, and alias objects in Oracle Internet Directory. For more information, please see RFC 3296, "Named Subordinate References in Lightweight Directory Access Protocol (LDAP) Directories," at http://www.ietf.org.

2.16.840.1.113894.1.8.1

OID_RESET_PROXYCONTROL_IDENTITY

Used to perform a proxy switch of an identity on an established LDAP connection. For example, suppose that Application A connects to the directory server and then wishes to switch to Application B. It can simply do a rebind by supplying the credentials of Application B. However, there are times when the proxy mechanism for the application to switch identities could be used even when the credentials are not available. With this control, Application A can switch to Application B provided Application A has the privilege in Oracle Internet Directory to proxy as Application B.

2.16.840.1.113894.1.8.2

OID_APPLYUSEPASSWORD_POLICY

Sent by applications that require Oracle Internet Directory to check for account lockout before sending the verifiers of the user to the application. If Oracle Internet Directory detects this control in the verifier search request and the user account is locked, then Oracle Internet Directory does not send the verifiers to the application. It sends an appropriate password policy error.

2.16.840.1.113894.1.8.3

CONNECT_BY

See Performing Hierarchical Searches Using CONNECT_BY Control.

2.16.840.1.113894.1.8.4

OID_CLIENT_IP_ADDRESS

Intended for a client to send the end user IP address if IP lockout is to be enforced by Oracle Internet Directory.

2.16.840.1.113894.1.8.5

GSL_REQDATTR_CONTROL

Used with dynamic groups. Directs the directory server to read the specific attributes of the members rather than the membership lists.

2.16.840.1.113894.1.8.6

PasswordStatusRequestControl

When packaged as part of the LDAP Bind/Compare operation request, this control causes the server to generate a password policy response control. The actual response control depends on the situation. Cases include imminent password expiration, number of grace logins remaining, password expired, and account locked.

2.16.840.1.113894.1.8.14

OID_DYNAMIC_VERIFIER_REQUEST_CONTROL

The request control that the client sends when it wants the server to create a dynamic password verifier. The server uses the parameters in the request control to construct the verifier.

2.16.840.1.113894.1.8.16

AccountStatusRequestControl

When packaged with the LDAP search operation associated with the authentication process, the Oracle Internet Directory returns a password policy response control to inform the client application of account state related information like account lockout, password expiration etc. The application can then parse and enforce the results.

2.16.840.1.113894.1.8.23

GSL_CERTIFICATE_CONTROL

Certificate search control. The request control that the client sends to specify how to search for a user certificate. See the appendix Searching the Directory for User Certificates in Oracle Fusion Middleware Administrator’s Guide for Oracle Internet Directory.

2.16.840.1.113894.1.8.29

EffectivePolicyControl

This control is packaged as part of an LDAP base search, where the base DN is that of the user entry being tested. The entry need not exist in the directory at the time. Passing this control results in the return of the LDAP entry describing the applicable password policy, assuming the entity performing the search has the access rights to view the password policy entry. If the desired password is provided as the optional testPassword parameter, the directory server returns the response control 2.16.840.1.113894.1.8.32.

2.16.840.1.113894.1.8.36

DelSubtreeControl

When this control is sent with a delete operation, it causes the deletion of the entire subtree below the DN provided. Any user having necessary privileges can perform this operation.

1.3.6.1.1.21.2

Transaction Specification Control

This is an LDAPControl indicating association of an operation to a transaction by means of the transaction identifier, which is the value of this control. Its criticality is TRUE.

1.3.6.1.4.1.42.2.27.8.5.1

Password Policy

Response control that the Oracle Internet Directory server returns to an LDAP client in response to the Password Policy request control. The response control value is encoded as follows:

PasswordPolicyResponseValue ::= SEQUENCE {
  warning [0] CHOICE {
  timeBeforeExpiration [0] INTEGER (0 .. maxInt),
  graceAuthNsRemaining [1] INTEGER (0 .. maxInt) } OPTIONAL,	
  error   [1] ENUMERATED {
  passwordExpired             (0),
  accountLocked               (1),
  changeAfterReset            (2),
  passwordModNotAllowed       (3),
  mustSupplyOldPassword       (4), /*currently not supported*/
  insufficientPasswordQuality (5),
  passwordTooShort            (6),
  passwordTooYoung            (7),
  passwordInHistory           (8) } OPTIONAL }

The Password Policy response control does not offer the mustSupplyOldPassword error code, because Oracle Internet Directory does not support the pwdsafemodify functionality.

The server sends either an error or warning in the password policy response control (but not both). Error codes are described in:

http://tools.ietf.org/html/draft-behera-ldap-password-policy-09

Control criticality is not returned in the response. For a non violation of the password policy, the server does not send a response.

2.16.840.1.113730.3.4.7

Entry Change Notification

Returned by the Oracle Internet Directory server to an LDAP client in response to a Persistent Search control that has the returnECs field set to TRUE. This control is returned for each changed entry that matches the persistent search criteria and describes the change made to the specific search entry.

The definition for this control is:

EntryChangeNotification ::= SEQUENCE {
     controlType 2.16.840.1.113730.3.4.7
     changeType ENUMERATED {
          add             (1),
          delete          (2),
          modify          (4),
          modDN           (8)
     },
     previousDN   LDAPDN OPTIONAL,     -- modifyDN ops. only
     changeNumber INTEGER OPTIONAL     -- if supported
}

For a description of these fields, see:

http://tools.ietf.org/id/draft-ietf-ldapext-psearch-03.txt

2.16.840.1.113730.3.4.10

OID_SEARCH_VLV_RES_CONTROL

The server sends this control in response to an OID_SEARCH_VLV_REQ_CONTROL 2.16.840.1.113730.3.4.9.

2.16.840.1.113894.1.8.7

OID_PASSWORD_EXPWARNING_CONTROL

Password policy control. Response control that the server sends when the pwdExpireWarning attribute is enabled and the client sends the request control. The response control value contains the time in seconds to password expiration.

2.16.840.1.113894.1.8.8

OID_PASSWORD_GRACELOGIN_CONTROL

Password policy control. The response control that the server sends when grace logins are configured and the client sends a request control. The response control value contains the remaining number of grace logins.

2.16.840.1.113894.1.8.20

OID_PWDEXPIRED_CONTROL

Password policy control. The response control that the server sends when the password has expired, there are no grace logins remaining, and the client sends a request control.

2.16.840.1.113894.1.8.9

OID_PASSWORD_MUSTCHANGE_CONTROL

Password policy control. The response control that the server sends when forced password reset is enabled and the client sends the request control. The client must force the user to change the password upon receipt of this control.

2.16.840.1.113894.1.8.15

OID_DYNAMIC_VERIFIER_RESPONSE_CONTROL

The response control that the server sends to the client when an error occurs. The response control contains the error code.

2.16.840.1.113894.1.8.32

PasswordValidationControl

The server sends this in response to control 2.16.840.1.113894.1.8.29 when the desired password is provided as the optional testPassword parameter. A client application can parse the validationResult to determine whether the password can be accepted by the server ("Success") or the reason it has been rejected. The same type of error message generated during a failed LDAP modify operation on userpassword is returned as the value.