Message Envelope (RFC4511 Section 4.1.1)

LDAPMessage ::= SEQUENCE {
     messageID       MessageID,
     protocolOp      CHOICE {
          bindRequest           BindRequest,
          bindResponse          BindResponse,
          unbindRequest         UnbindRequest,
          searchRequest         SearchRequest,
          searchResEntry        SearchResultEntry,
          searchResDone         SearchResultDone,
          searchResRef          SearchResultReference,
          modifyRequest         ModifyRequest,
          modifyResponse        ModifyResponse,
          addRequest            AddRequest,
          addResponse           AddResponse,
          delRequest            DelRequest,
          delResponse           DelResponse,
          modDNRequest          ModifyDNRequest,
          modDNResponse         ModifyDNResponse,
          compareRequest        CompareRequest,
          compareResponse       CompareResponse,
          abandonRequest        AbandonRequest,
          extendedReq           ExtendedRequest,
          extendedResp          ExtendedResponse,
          ...,
          intermediateResponse  IntermediateResponse },
     controls       [0] Controls OPTIONAL }

Message ID (RFC4511 Section 4.1.1.1)

MessageID ::= INTEGER (0 ..  maxInt)

LDAPv3 protocol ASN.1 constant as per RFC4511 Section 4.1.1

maxInt INTEGER ::= 2147483647 -- (2^^31 - 1)

CHOICE type inlined in LDAPMessage.protocolOp (RFC4511 Section 4.1.1)

String Type (RFC4511 Section 4.1.2)

LDAPString ::= OCTET STRING -- UTF-8 encoded,
                            -- [ISO10646] characters

Object identifier (RFC4511 Section 4.1.2)

LDAPOID ::= OCTET STRING -- Constrained to <numericoid>
                         -- [RFC4512]

Distinguished Name (RFC4511 Section 4.1.3)

LDAPDN ::= LDAPString -- Constrained to <distinguishedName>
                      -- [RFC4514]

Relative Distinguished Name (RFC4511 Section 4.1.3)

RelativeLDAPDN ::= LDAPString -- Constrained to <name-component>
                              -- [RFC4514]

Attribute Descriptions (RFC4511 Section 4.1.4)

AttributeDescription ::= LDAPString
                        -- Constrained to <attributedescription>
                        -- [RFC4512]

Attribute Value (RFC4511 Section 4.1.5)

AttributeValue ::= OCTET STRING

Attribute Value Assertion (RFC4511 Section 4.1.6)

AttributeValueAssertion ::= SEQUENCE {
     attributeDesc   AttributeDescription,
     assertionValue  AssertionValue }

AssertionValue ::= OCTET STRING

Partial Attribute (RFC4511 Section 4.1.7)

PartialAttribute ::= SEQUENCE {
     type       AttributeDescription,
     vals       SET OF value AttributeValue }

Attribute (RFC4511 Section 4.1.7)

Attribute ::= PartialAttribute(WITH COMPONENTS {
     ...,
     vals (SIZE(1..MAX))})

Matching Rule Identifier (RFC4511 Section 4.1.8)

MatchingRuleId ::= LDAPString

Result Message (RFC4511 Section 4.1.9)

LDAPResult ::= SEQUENCE {
     resultCode         ENUMERATED {
          success                      (0),
          operationsError              (1),
          protocolError                (2),
          timeLimitExceeded            (3),
          sizeLimitExceeded            (4),
          compareFalse                 (5),
          compareTrue                  (6),
          authMethodNotSupported       (7),
          strongerAuthRequired         (8),
               -- 9 reserved --
          referral                     (10),
          adminLimitExceeded           (11),
          unavailableCriticalExtension (12),
          confidentialityRequired      (13),
          saslBindInProgress           (14),
          noSuchAttribute              (16),
          undefinedAttributeType       (17),
          inappropriateMatching        (18),
          constraintViolation          (19),
          attributeOrValueExists       (20),
          invalidAttributeSyntax       (21),
               -- 22-31 unused --
          noSuchObject                 (32),
          aliasProblem                 (33),
          invalidDNSyntax              (34),
               -- 35 reserved for undefined isLeaf --
          aliasDereferencingProblem    (36),
               -- 37-47 unused --
          inappropriateAuthentication  (48),
          invalidCredentials           (49),
          insufficientAccessRights     (50),
          busy                         (51),
          unavailable                  (52),
          unwillingToPerform           (53),
          loopDetect                   (54),
               -- 55-63 unused --
          namingViolation              (64),
          objectClassViolation         (65),
          notAllowedOnNonLeaf          (66),
          notAllowedOnRDN              (67),
          entryAlreadyExists           (68),
          objectClassModsProhibited    (69),
               -- 70 reserved for CLDAP --
          affectsMultipleDSAs          (71),
               -- 72-79 unused --
          other                        (80),
          ...  },
     matchedDN          LDAPDN,
     diagnosticMessage  LDAPString,
     referral           [3] Referral OPTIONAL }

LDAPResult Result Code

Referral result code (RFC4511 Section 4.1.10)

Referral ::= SEQUENCE SIZE (1..MAX) OF uri URI

URI ::= LDAPString     -- limited to characters permitted in
                       -- URIs

Controls (RFC4511 Section 4.1.11)

Controls ::= SEQUENCE OF control Control

Control Entry (RFC4511 Section 4.1.11)

Control ::= SEQUENCE {
     controlType             LDAPOID,
     criticality             BOOLEAN DEFAULT FALSE,
     controlValue            OCTET STRING OPTIONAL }

Bind Request (RFC4511 Section 4.2)

BindRequest ::= [APPLICATION 0] SEQUENCE {
     version                 INTEGER (1 ..  127),
     name                    LDAPDN,
     authentication          AuthenticationChoice }

See BindRequest

AuthenticationChoice ::= CHOICE {
     simple                  [0] OCTET STRING,
                             -- 1 and 2 reserved
     sasl                    [3] SaslCredentials,
     ...  }

See AuthenticationChoice

SaslCredentials ::= SEQUENCE {
     mechanism               LDAPString,
     credentials             OCTET STRING OPTIONAL }

Bind Response (RFC4511 Section 4.2)

BindResponse ::= [APPLICATION 1] SEQUENCE {
     COMPONENTS OF LDAPResult,
     serverSaslCreds    [7] OCTET STRING OPTIONAL }

Unbind Operation (RFC4511 Section 4.3)

UnbindRequest ::= [APPLICATION 2] NULL

Search Request (RFC4511 Section 4.5.1)

SearchRequest ::= [APPLICATION 3] SEQUENCE {
     baseObject      LDAPDN,
     scope           ENUMERATED {
          baseObject              (0),
          singleLevel             (1),
          wholeSubtree            (2),
          ...  },
     derefAliases    ENUMERATED {
          neverDerefAliases       (0),
          derefInSearching        (1),
          derefFindingBaseObj     (2),
          derefAlways             (3) },
     sizeLimit       INTEGER (0 ..  maxInt),
     timeLimit       INTEGER (0 ..  maxInt),
     typesOnly       BOOLEAN,
     filter          Filter,
     attributes      AttributeSelection }

See SearchRequest (RFC4511 Section 4.5.1.2)

See SearchRequest (RFC4511 Section 4.5.1.3)

See SearchRequest

AttributeSelection ::= SEQUENCE OF selector LDAPString
               -- The LDAPString is constrained to
               -- <attributeSelector> in Section 4.5.1.8

Search Filter (RFC4511 Section 4.5.1.7)

Filter ::= CHOICE {
     and             [0] SET SIZE (1..MAX) OF filter Filter,
     or              [1] SET SIZE (1..MAX) OF filter Filter,
     not             [2] Filter,
     equalityMatch   [3] AttributeValueAssertion,
     substrings      [4] SubstringFilter,
     greaterOrEqual  [5] AttributeValueAssertion,
     lessOrEqual     [6] AttributeValueAssertion,
     present         [7] AttributeDescription,
     approxMatch     [8] AttributeValueAssertion,
     extensibleMatch [9] MatchingRuleAssertion,
     ...  }

Substring Filter (RFC4511 Section 4.5.1.7.2)

SubstringFilter ::= SEQUENCE {
     type           AttributeDescription,
     substrings     SEQUENCE SIZE (1..MAX) OF substring CHOICE {
          initial [0] AssertionValue,  -- can occur at most once
          any     [1] AssertionValue,
          final   [2] AssertionValue } -- can occur at most once
     }

NOTE: The additional invariants imposed on the ordering and occurence counts of the initial and final entries MUST currently be enforced by the consumer of this library. Future versions of this library might change to enforce these invariants at the type-level.

Specifically, the invariant stated by the specification is:

There SHALL be at most one initial and at most one final in the substrings of a SubstringFilter. If initial is present, it SHALL be the first element of substrings. If final is present, it SHALL be the last element of substrings.

See SubstringFilter

See SearchRequest Filter

MatchingRuleAssertion ::= SEQUENCE {
     matchingRule    [1] MatchingRuleId OPTIONAL,
     type            [2] AttributeDescription OPTIONAL,
     matchValue      [3] AssertionValue,
     dnAttributes    [4] BOOLEAN DEFAULT FALSE }

Search Result Entry (RFC4511 Section 4.5.2)

SearchResultEntry ::= [APPLICATION 4] SEQUENCE {
     objectName      LDAPDN,
     attributes      PartialAttributeList }

See SearchResultEntry

PartialAttributeList ::= SEQUENCE OF
                     partialAttribute PartialAttribute

Search Result Continuation Reference (RFC4511 Section 4.5.3)

SearchResultReference ::= [APPLICATION 19] SEQUENCE
                          SIZE (1..MAX) OF uri URI

Search Result Done (RFC4511 Section 4.5.2)

SearchResultDone ::= [APPLICATION 5] LDAPResult

Modify Operation (RFC4511 Section 4.6)

ModifyRequest ::= [APPLICATION 6] SEQUENCE {
     object          LDAPDN,
     changes         SEQUENCE OF change SEQUENCE {
          operation       ENUMERATED {
               add     (0),
               delete  (1),
               replace (2),
               ...  },
          modification    PartialAttribute } }

See ModifyRequest

See ModifyRequest and Change