INTERNET-DRAFT                                     Michael P. Armijo
   <draft-armijo-ldap-control-error-02.txt>       Microsoft Corporation
   September, 2001                                           Asaf Kashi
                                                  Microsoft Corporation



                       Result Code for LDAP Controls


Status of this Memo

   This document is an Internet-Draft and is in full conformance with
   all provisions of Section 10 of RFC2026.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six
   months and may be updated, replaced, or obsoleted by other documents
   at any time.  It is inappropriate to use Internet- Drafts as
   reference material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   Distribution of this memo is unlimited.  It is filed as <draft-
   armijo-ldap-control-error-02.txt>, and expires March, 2001.

   Please send comments to the author.


Abstract

   The purpose of this document is to create a new result code specific
   to LDAP controls and to define guidelines for the use of this result
   code.


1. Background and Intended Usage

   LDAPv3 [1] allows for the extension of the protocol through the use
   of controls.  These controls allow existing operations to be
   enhanced to provide additional functionality for directory
   operations.  Complex controls are being established that are
   bringing up error conditions not anticipated in the LDAPv3
   specifications.


   Armijo                  Standards Track                          1
                    Result Code for LDAP Controls         August 2001

   This document provides a result code that can be used to signify a
   control specific error.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in
   this document are to be interpreted as described in RFC 2119 [2].


2. The LDAP Control Result Code

   The LDAPResult construct as defined in section 4.1.10 of RFC 2251
   [1] includes a list of valid result codes.  The LDAPResult construct
   is repeated here for readability:


   LDAPResult ::= SEQUENCE {
                resultCode    ENUMERATED {
                             success                      (0),
                             operationsError              (1),
                             protocolError                (2),
                             timeLimitExceeded            (3),
                             sizeLimitExceeded            (4),
                             compareFalse                 (5),
                             compareTrue                  (6),
                             authMethodNotSupported       (7),
                             strongAuthRequired           (8),
                                        -- 9 reserved --
                             referral                     (10),  -- new
                             adminLimitExceeded           (11),  -- new
                             unavailableCriticalExtension (12),  -- new
                             confidentialityRequired      (13),  -- new
                             saslBindInProgress           (14),  -- new
                             noSuchAttribute              (16),
                             undefinedAttributeType       (17),
                             inappropriateMatching        (18),
                             constraintViolation          (19),
                             attributeOrValueExists       (20),
                             invalidAttributeSyntax       (21),
                                        -- 22-31 unused --
                             noSuchObject                 (32),
                             aliasProblem                 (33),
                             invalidDNSyntax              (34),
                             -- 35 reserved for undefined isLeaf --
                             aliasDereferencingProblem    (36),
                                        -- 37-47 unused --
                             inappropriateAuthentication  (48),
                             invalidCredentials           (49),
                             insufficientAccessRights     (50),
                             busy                         (51),
                             unavailable                  (52),
                             unwillingToPerform           (53),
                             loopDetect                   (54),
                                        -- 55-63 unused --
                             namingViolation              (64),

   Armijo                  Standards Track                          2
                    Result Code for LDAP Controls         August 2001

                             objectClassViolation         (65),
                             notAllowedOnNonLeaf          (66),
                             notAllowedOnRDN              (67),
                             entryAlreadyExists           (68),
                             objectClassModsProhibited    (69),
                                    -- 70 reserved for CLDAP --
                             affectsMultipleDSAs          (71), -- new
                                    -- 72-79 unused --
                             other                        (80) },
                               -- 81-90 reserved for APIs --
                matchedDN       LDAPDN,
                errorMessage    LDAPString,
                referral        [3] Referral OPTIONAL }



   This document adds another valid result code, controlError(76).


3. Use of the LDAP Control Result Code

   The controlError MUST be defined in any control specification that
   makes use of the result code.  The scenario of when the controlError
   result code may be returned and the exact behavior of the client
   with particular controls MUST be defined in any control
   specification that refers to this result code.

   The controlError result code can be returned when an operation has
   failed due to an error caused by an attached control.  The
   controlError SHOULD NOT be used to represent any condition that can
   be defined using any existing result code in RFC 2251.

   The controlError result code MAY be defined in control
   specifications to signify that the client should parse an embedded
   result code for additional control specific results.


4. Security Considerations

   This document defines an extension to RFC 2251 [1] and has the same
   security issues.  See the security considerations section in [1] for
   more details.


5. References

   [1]  Wahl, M., Howes, T. and S. Kille, "Lightweight Directory Access
   Protocol(v3)", RFC 2251, December 1997.

   [2]  Bradner, S., "Key words for use in RFCs to Indicate Requirement
   Levels", RFC 2119, March 1997



   Armijo                  Standards Track                          3
                    Result Code for LDAP Controls         August 2001

6. Authors Address

   Asaf Kashi
   One Microsoft Way
   Redmond, WA 98052
   asafk@microsoft.com

   Michael P. Armijo
   One Microsoft Way
   Redmond, WA 98052
   micharm@microsoft.com

   Expires March, 2002


   Armijo                  Standards Track                          4