Subject: Re: appropriateness of combination of controls (new suggestion)

From: "Jim Sermersheim" <[email-masked]>
Date: Sat, 15 May 2004 09:02:25 -0600

>>> "Kurt D. Zeilenga" <[email-masked]> 5/15/04 7:54:50 AM >>>
>At 10:32 PM 5/14/2004, Jim Sermersheim wrote:
>>It disallows combinations of other controls (like VLV and PSearch)
and returns an error if these are combined. I don't have code available
right now or I could tell you what >the error is (I assume it's
unwillingToPerform). 
>
>Question: if both VLV and Psearch were marked critical, would
>the error you returned be different? 

No, the routine that checks for known/appropriate controls is different
from the routine(s) which will return errors for invalid combinations.
We kept the former very simple (do we understand this control, and is it
appropriate for this operation). At this point of checking, we don't
even know if there are more controls in the message.

It would be good to know what other implementations do. I know there
are some others that support VLV and PSearch. I wonder how they handle
the combination?

Jim

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 15 May 2004 08:47:22 -0700

>even know if there are more controls in the message.

Do you also handle a message with two critical manageDsaIT
controls in the same fashion?

Do you also handle a message with two (different) critical
Psearch controls in the same fashion?

>are some others that support VLV and PSearch. I wonder how they handle

Well, I checked our code and, to my surpise, it wasn't as
I previously described.  OpenLDAP slapd(8) response of say:
        search+ManageDsaIT+manageDsaIT
        search+subentries+subentries

would be to return protocolError.  Given this, I retract my
suggested text.

If we're going to recommend returning an error here, I think
we should specifically recommend return of protocolError over
a code like unwillingToPerform.

unwillingToPerform implies that the operation can be performed,
but that this particular server is unwilling or unable to perform
the operation (at this time).  protocolError more accurately
reflects that the server cannot make sense of the request.

Kurt

---

From: Michael Ströder <[email-masked]>
Date: Mon, 17 May 2004 08:24:55 +0200

Kurt D. Zeilenga wrote:>
 > reflects that the server cannot make sense of the request.

+1

protocolError would signal the LDAP client developer that there's really 
something going wrong in the client implementation which must be fixed to work.

Ciao, Michael.