aboutsummaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
authorDavid M. Syzdek <david@syzdek.net>2019-12-02 01:15:27 -0900
committerDavid M. Syzdek <david@syzdek.net>2019-12-02 01:15:27 -0900
commit70475325ed74a6a02f90a6e56aede852511fc19a (patch)
treee85066a7f00568e8eb58a5d224d4267dda43094a
parent881720459a7c63d9b1424af66d8a48312205b1c6 (diff)
downloadldap-utils-70475325ed74a6a02f90a6e56aede852511fc19a.tar.gz
ldap-utils-70475325ed74a6a02f90a6e56aede852511fc19a.tar.bz2
ldap-utils-70475325ed74a6a02f90a6e56aede852511fc19a.tar.xz
ldap-utils-70475325ed74a6a02f90a6e56aede852511fc19a.zip
oidspec: adding microsoft OIDs
Diffstat
-rw-r--r--Makefile.am3
-rw-r--r--doc/oidspecs/vendors/microsoft.oidspec1635
2 files changed, 1637 insertions, 1 deletions
diff --git a/Makefile.am b/Makefile.am
index 4888a22..d19ac51 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -100,7 +100,8 @@ OIDSPEC_FILES = $(srcdir)/doc/oidspecs/iana-ldap-parameters.oidspec \
100 $(srcdir)/doc/oidspecs/rfc/rfc4512.oidspec \ 100 $(srcdir)/doc/oidspecs/rfc/rfc4512.oidspec \
101 $(srcdir)/doc/oidspecs/rfc/rfc4517.oidspec \ 101 $(srcdir)/doc/oidspecs/rfc/rfc4517.oidspec \
102 $(srcdir)/doc/oidspecs/rfc/rfc4523.oidspec \ 102 $(srcdir)/doc/oidspecs/rfc/rfc4523.oidspec \
103 $(srcdir)/doc/oidspecs/rfc/rfc4530.oidspec 103 $(srcdir)/doc/oidspecs/rfc/rfc4530.oidspec \
104 $(srcdir)/doc/oidspecs/vendors/microsoft.oidspec
104MY_OIDSPECFLAGS = --include=lspecdata.h \ 105MY_OIDSPECFLAGS = --include=lspecdata.h \
105 --include=lspec.h \ 106 --include=lspec.h \
106 --sparse \ 107 --sparse \
diff --git a/doc/oidspecs/vendors/microsoft.oidspec b/doc/oidspecs/vendors/microsoft.oidspec
new file mode 100644
index 0000000..b669f13
--- /dev/null
+++ b/doc/oidspecs/vendors/microsoft.oidspec
@@ -0,0 +1,1635 @@
1//
2// Microsoft: Open Specifications
3// 3.1.1.3.4.1 LDAP Extended Controls
4// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea
5//
6// LDAP extended controls are an extensibility mechanism in version 3 of LDAP,
7// as discussed in [RFC2251] section 4.1.12. The following sections describe
8// the LDAP extended controls implemented by DCs in Windows 2000 operating
9// system and later (both AD DS and AD LDS).
10//
11// The LDAP extended controls supported by a DC are exposed as OIDs in the
12// supportedControl attribute of the rootDSE. Each OID corresponds to a
13// human-readable name, as shown in the following table.
14//
15// Extended control name | OID
16// -------------------------------------------+------------------------------
17// LDAP_PAGED_RESULT_OID_STRING | 1.2.840.113556.1.4.319
18// LDAP_SERVER_CROSSDOM_MOVE_TARGET_OID | 1.2.840.113556.1.4.521
19// LDAP_SERVER_DIRSYNC_OID | 1.2.840.113556.1.4.841
20// LDAP_SERVER_DOMAIN_SCOPE_OID | 1.2.840.113556.1.4.1339
21// LDAP_SERVER_EXTENDED_DN_OID | 1.2.840.113556.1.4.529
22// LDAP_SERVER_GET_STATS_OID | 1.2.840.113556.1.4.970
23// LDAP_SERVER_LAZY_COMMIT_OID | 1.2.840.113556.1.4.619
24// LDAP_SERVER_PERMISSIVE_MODIFY_OID | 1.2.840.113556.1.4.1413
25// LDAP_SERVER_NOTIFICATION_OID | 1.2.840.113556.1.4.528
26// LDAP_SERVER_RESP_SORT_OID | 1.2.840.113556.1.4.474
27// LDAP_SERVER_SD_FLAGS_OID | 1.2.840.113556.1.4.801
28// LDAP_SERVER_SEARCH_OPTIONS_OID | 1.2.840.113556.1.4.1340
29// LDAP_SERVER_SORT_OID | 1.2.840.113556.1.4.473
30// LDAP_SERVER_SHOW_DELETED_OID | 1.2.840.113556.1.4.417
31// LDAP_SERVER_TREE_DELETE_OID | 1.2.840.113556.1.4.805
32// LDAP_SERVER_VERIFY_NAME_OID | 1.2.840.113556.1.4.1338
33// LDAP_CONTROL_VLVREQUEST | 2.16.840.1.113730.3.4.9
34// LDAP_CONTROL_VLVRESPONSE | 2.16.840.1.113730.3.4.10
35// LDAP_SERVER_ASQ_OID | 1.2.840.113556.1.4.1504
36// LDAP_SERVER_QUOTA_CONTROL_OID | 1.2.840.113556.1.4.1852
37// LDAP_SERVER_RANGE_OPTION_OID | 1.2.840.113556.1.4.802
38// LDAP_SERVER_SHUTDOWN_NOTIFY_OID | 1.2.840.113556.1.4.1907
39// LDAP_SERVER_FORCE_UPDATE_OID | 1.2.840.113556.1.4.1974
40// LDAP_SERVER_RANGE_RETRIEVAL_NOERR_OID | 1.2.840.113556.1.4.1948
41// LDAP_SERVER_RODC_DCPROMO_OID | 1.2.840.113556.1.4.1341
42// LDAP_SERVER_DN_INPUT_OID | 1.2.840.113556.1.4.2026
43// LDAP_SERVER_SHOW_DEACTIVATED_LINK_OID | 1.2.840.113556.1.4.2065
44// LDAP_SERVER_SHOW_RECYCLED_OID | 1.2.840.113556.1.4.2064
45// LDAP_SERVER_POLICY_HINTS_DEPRECATED_OID | 1.2.840.113556.1.4.2066
46// LDAP_SERVER_DIRSYNC_EX_OID | 1.2.840.113556.1.4.2090
47// LDAP_SERVER_UPDATE_STATS_OID | 1.2.840.113556.1.4.2205
48// LDAP_SERVER_TREE_DELETE_EX_OID | 1.2.840.113556.1.4.2204
49// LDAP_SERVER_SEARCH_HINTS_OID | 1.2.840.113556.1.4.2206
50// LDAP_SERVER_EXPECTED_ENTRY_COUNT_OID | 1.2.840.113556.1.4.2211
51// LDAP_SERVER_POLICY_HINTS_OID | 1.2.840.113556.1.4.2239
52// LDAP_SERVER_SET_OWNER_OID | 1.2.840.113556.1.4.2255
53// LDAP_SERVER_BYPASS_QUOTA_OID | 1.2.840.113556.1.4.2256
54// LDAP_SERVER_LINK_TTL_OID | 1.2.840.113556.1.4.2309
55// LDAP_SERVER_SET_CORRELATION_ID_OID | 1.2.840.113556.1.4.2330
56// LDAP_SERVER_THREAD_TRACE_OVERRIDE_OID | 1.2.840.113556.1.4.2354
57//
58// Not all applicable Windows Server releases and Active Directory
59// Application Mode (ADAM) versions support all the LDAP capabilities.
60//
61{
62 .oid = "1.2.840.113556.1.4.521",
63 .name = "LDAP_SERVER_CROSSDOM_MOVE_TARGET_OID",
64 .desc = "LDAP_SERVER_CROSSDOM_MOVE_TARGET_OID",
65 .flags = 0,
66 .type = LDAPSCHEMA_CONTROL,
67 .def = NULL,
68 .spec = "Microsoft: Open Specifications",
69 .spec_type = LDAPSCHEMA_SPEC_URL,
70 .spec_name = "Open Specifications",
71 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
72 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
73 .spec_vendor = "Microsoft",
74 .spec_text = "The LDAP_SERVER_CROSSDOM_MOVE_TARGET_OID control is"
75 " used with an LDAP Modify DN operation to instruct the"
76 " DC to move an object from one domain to another (see"
77 " the Modify DN operation in section 3.1.1.5). This"
78 " control is used by the client when moving an object"
79 " from one domain to another. The client sends the LDAP"
80 " Modify DN operation to which this control is attached"
81 " to a DC in the domain containing the object to be moved."
82 " If the client does not specify the"
83 " LDAP_SERVER_CROSSDOM_MOVE_TARGET_OID control in the LDAP"
84 " Modify DN request, then the server interprets the update"
85 " as an intradomain Modify DN operation.\n"
86 "\n"
87 "When operating as AD LDS, a DC rejects this control"
88 " with the error operationsError / <unrestricted>.\n"
89 "\n"
90 "When sending this control to the DC, the controlValue"
91 " field is set to a UTF-8 string containing the fully"
92 " qualified domain name (1) of a DC in the domain to"
93 " which the object is to be moved. The string is not"
94 " BER-encoded. Sending this control to the DC does not"
95 " cause the server to include any controls in its"
96 " response.\n",
97 .notes = NULL,
98};
99{
100 .oid = "1.2.840.113556.1.4.841",
101 .name = "LDAP_SERVER_DIRSYNC_OID",
102 .desc = "LDAP_SERVER_DIRSYNC_OID",
103 .flags = 0,
104 .type = LDAPSCHEMA_CONTROL,
105 .def = NULL,
106 .spec = "Microsoft: Open Specifications",
107 .spec_type = LDAPSCHEMA_SPEC_URL,
108 .spec_name = "Open Specifications",
109 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
110 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
111 .spec_vendor = "Microsoft",
112 .spec_text = "The LDAP_SERVER_DIRSYNC_OID control is used with an"
113 " LDAP search operation to retrieve the changes made to"
114 " objects since a previous search with an"
115 " LDAP_SERVER_DIRSYNC_OID control was performed. The"
116 " LDAP_SERVER_DIRSYNC_OID control can only be used to"
117 " monitor for changes across an entire NC replica, not a"
118 " subtree within an NC replica.\n",
119 .notes = NULL,
120};
121{
122 .oid = "1.2.840.113556.1.4.1339",
123 .name = "LDAP_SERVER_DOMAIN_SCOPE_OID",
124 .desc = "LDAP_SERVER_DOMAIN_SCOPE_OID",
125 .flags = 0,
126 .type = LDAPSCHEMA_CONTROL,
127 .def = NULL,
128 .spec = "Microsoft: Open Specifications",
129 .spec_type = LDAPSCHEMA_SPEC_URL,
130 .spec_name = "Open Specifications",
131 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
132 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
133 .spec_vendor = "Microsoft",
134 .spec_text = "The LDAP_SERVER_DOMAIN_SCOPE_OID control is used to"
135 " instruct the DC not to generate any LDAP continuation"
136 " references when performing an LDAP operation. The"
137 " effect of this is to limit any search using it to the"
138 " single NC replica in which the object that serves as"
139 " the root of the search is located.\n"
140 "\n"
141 "When sending this control to the DC, the controlValue"
142 " field of the Control structure is omitted. Sending this"
143 " control to the DC does not cause the server to include"
144 " any controls in its response.\n",
145 .notes = NULL,
146};
147{
148 .oid = "1.2.840.113556.1.4.529",
149 .name = "LDAP_SERVER_EXTENDED_DN_OID",
150 .desc = "LDAP_SERVER_EXTENDED_DN_OID",
151 .flags = 0,
152 .type = LDAPSCHEMA_CONTROL,
153 .def = NULL,
154 .spec = "Microsoft: Open Specifications",
155 .spec_type = LDAPSCHEMA_SPEC_URL,
156 .spec_name = "Open Specifications",
157 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
158 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
159 .spec_vendor = "Microsoft",
160 .spec_text = "The LDAP_SERVER_EXTENDED_DN_OID control is used with an"
161 " LDAP search request to cause the DC to return extended"
162 " DNs. The extended form of an object's DN includes a"
163 " string representation of the object's objectGUID"
164 " attribute; for objects that have an objectSid"
165 " attribute, the extended form also includes a string"
166 " representation of that attribute. The DC uses this"
167 " extended DN for all DNs in the LDAP search response."
168 " Attributes with Object(OR-Name) syntax are not affected"
169 " by this control, because in those cases, the DC always"
170 " uses the DN form as specified in [RFC2253].\n",
171 .notes = NULL,
172};
173{
174 .oid = "1.2.840.113556.1.4.970",
175 .name = "LDAP_SERVER_GET_STATS_OID",
176 .desc = "LDAP_SERVER_GET_STATS_OID",
177 .flags = 0,
178 .type = LDAPSCHEMA_CONTROL,
179 .def = NULL,
180 .spec = "Microsoft: Open Specifications",
181 .spec_type = LDAPSCHEMA_SPEC_URL,
182 .spec_name = "Open Specifications",
183 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
184 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
185 .spec_vendor = "Microsoft",
186 .spec_text = "The LDAP_SERVER_GET_STATS_OID control is used with an"
187 " LDAP search operation.\n",
188 .notes = NULL,
189};
190{
191 .oid = "1.2.840.113556.1.4.619",
192 .name = "LDAP_SERVER_LAZY_COMMIT_OID",
193 .desc = "LDAP_SERVER_LAZY_COMMIT_OID",
194 .flags = 0,
195 .type = LDAPSCHEMA_CONTROL,
196 .def = NULL,
197 .spec = "Microsoft: Open Specifications",
198 .spec_type = LDAPSCHEMA_SPEC_URL,
199 .spec_name = "Open Specifications",
200 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
201 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
202 .spec_vendor = "Microsoft",
203 .spec_text = "The LDAP_SERVER_LAZY_COMMIT_OID control is used to"
204 " modify the behavior of any LDAP operation. The"
205 " presence of this control instructs the DC that it can"
206 " sacrifice durability guarantees on updates to improve"
207 " performance.\n"
208 "\n"
209 "When sending this control to the DC, the controlValue"
210 " field of the Control structure is omitted. Sending this"
211 " control to the DC does not cause the server to include"
212 " any controls in its response.\n",
213 .notes = NULL,
214};
215{
216 .oid = "1.2.840.113556.1.4.1413",
217 .name = "LDAP_SERVER_PERMISSIVE_MODIFY_OID",
218 .desc = "LDAP_SERVER_PERMISSIVE_MODIFY_OID",
219 .flags = 0,
220 .type = LDAPSCHEMA_CONTROL,
221 .def = NULL,
222 .spec = "Microsoft: Open Specifications",
223 .spec_type = LDAPSCHEMA_SPEC_URL,
224 .spec_name = "Open Specifications",
225 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
226 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
227 .spec_vendor = "Microsoft",
228 .spec_text = "The LDAP_SERVER_PERMISSIVE_MODIFY_OID control is used to"
229 " modify the behavior of an LDAP modify operation. An"
230 " LDAP modify operation normally returns an error if it"
231 " attempts to add an attribute that already exists on an"
232 " object to that object (or, in the case of multivalued"
233 " attributes, it attempts to add a value that is already"
234 " present in the attribute). An LDAP modify operation will"
235 " also normally fail if it attempts to delete an attribute"
236 " that does not exist on the specified object or that does"
237 " not contain the value specified in the deletion request."
238 " With this control, adding a value to an attribute that"
239 " already exists and already contains the value to be"
240 " added will cause the server to return success even"
241 " though no modification was actually performed by the"
242 " server. Similarly, deletion of an attribute that does"
243 " not exist or does not contain the specified value will"
244 " return success.\n"
245 "\n"
246 "When sending this control to the DC, the controlValue"
247 " field of the Control structure is omitted. Sending this"
248 " control to the DC does not cause the server to include"
249 " any controls in its response.\n",
250 .notes = NULL,
251};
252{
253 .oid = "1.2.840.113556.1.4.528",
254 .name = "LDAP_SERVER_NOTIFICATION_OID",
255 .desc = "LDAP_SERVER_NOTIFICATION_OID",
256 .flags = 0,
257 .type = LDAPSCHEMA_CONTROL,
258 .def = NULL,
259 .spec = "Microsoft: Open Specifications",
260 .spec_type = LDAPSCHEMA_SPEC_URL,
261 .spec_name = "Open Specifications",
262 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
263 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
264 .spec_vendor = "Microsoft",
265 .spec_text = "The LDAP_SERVER_NOTIFICATION_OID control is used with"
266 " an LDAP search operation to register the client that"
267 " is to be notified when changes are made to an object"
268 " in the directory.\n"
269 "\n"
270 "Notifications are asynchronous operations. When the DC"
271 " receives a search request with this control attached,"
272 " it does not immediately send a response to the request."
273 " Instead, when an object is modified, if that object"
274 " falls within the scope of the search request to which"
275 " the LDAP_SERVER_NOTIFICATION_OID control was attached,"
276 " the DC sends a SearchEntry response that contains the"
277 " modified object to the client, using the messageID from"
278 " the original search request (SearchEntry and messageID"
279 " are defined in [RFC2251] section 4.1.1). The"
280 " SearchEntry response will contain those attributes of"
281 " the object that were requested in the original request."
282 " These attributes are not necessarily the attributes"
283 " that were modified. A client indicates that it no"
284 " longer requires notifications by sending an LDAP"
285 " abandon operation, specifying the messageID of the"
286 " original search request.\n"
287 "\n"
288 "LDAP search requests that include this control are"
289 " subject to the following restrictions:\n"
290 "\n"
291 " * The only filter permitted in the search request is"
292 " \"(objectclass = *)\". The server will return the error"
293 " unwillingToPerform / <unrestricted> if this is not the"
294 " case.\n"
295 "\n"
296 " * Base, one-level, and subtree search scopes are"
297 " permitted. For Windows 2000 operating system DCs, if"
298 " the base DN specified in a subtree search is not the"
299 " root of an NC, the server returns the error"
300 " unwillingToPerform / <unrestricted>. Windows Server"
301 " 2003 operating system and later DCs do not have this"
302 " restriction.\n"
303 "\n"
304 "When sending this control to the DC, the controlValue"
305 " field of the Control structure is omitted. Sending"
306 " this control to the DC does not cause the server to"
307 " include any controls in its eventual responses.\n",
308 .notes = NULL,
309};
310{
311 .oid = "1.2.840.113556.1.4.801",
312 .name = "LDAP_SERVER_SD_FLAGS_OID",
313 .desc = "LDAP_SERVER_SD_FLAGS_OID",
314 .flags = 0,
315 .type = LDAPSCHEMA_CONTROL,
316 .def = NULL,
317 .spec = "Microsoft: Open Specifications",
318 .spec_type = LDAPSCHEMA_SPEC_URL,
319 .spec_name = "Open Specifications",
320 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
321 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
322 .spec_vendor = "Microsoft",
323 .spec_text = "The LDAP_SERVER_SD_FLAGS_OID control is used with an"
324 " LDAP Search request to control the portion of a"
325 " Windows security descriptor to retrieve. The DC"
326 " returns only the specified portion of the security"
327 " descriptors. It is also used with LDAP Add and Modify"
328 " requests to control the portion of a Windows security"
329 " descriptor to modify. The DC modifies only the"
330 " specified portion of the security descriptor.\n",
331 .notes = NULL,
332};
333{
334 .oid = "1.2.840.113556.1.4.1340",
335 .name = "LDAP_SERVER_SEARCH_OPTIONS_OID",
336 .desc = "LDAP_SERVER_SEARCH_OPTIONS_OID",
337 .flags = 0,
338 .type = LDAPSCHEMA_CONTROL,
339 .def = NULL,
340 .spec = "Microsoft: Open Specifications",
341 .spec_type = LDAPSCHEMA_SPEC_URL,
342 .spec_name = "Open Specifications",
343 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
344 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
345 .spec_vendor = "Microsoft",
346 .spec_text = "The LDAP_SERVER_SEARCH_OPTIONS_OID control is used with"
347 " an LDAP Search request to control various behaviors.\n",
348 .notes = NULL,
349};
350{
351 .oid = "1.2.840.113556.1.4.417",
352 .name = "LDAP_SERVER_SHOW_DELETED_OID",
353 .desc = "LDAP_SERVER_SHOW_DELETED_OID",
354 .flags = 0,
355 .type = LDAPSCHEMA_CONTROL,
356 .def = NULL,
357 .spec = "Microsoft: Open Specifications",
358 .spec_type = LDAPSCHEMA_SPEC_URL,
359 .spec_name = "Open Specifications",
360 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
361 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
362 .spec_vendor = "Microsoft",
363 .spec_text = "The LDAP_SERVER_SHOW_DELETED_OID control is used with"
364 " an LDAP operation to specify that tombstones and"
365 " deleted-objects must be visible to the operation. For"
366 " example, when the control is used with an LDAP search"
367 " operation, the search results include any tombstones"
368 " or deleted-objects that match the search filter.\n",
369 .notes = NULL,
370};
371{
372 .oid = "1.2.840.113556.1.4.805",
373 .name = "LDAP_SERVER_TREE_DELETE_OID",
374 .desc = "LDAP_SERVER_TREE_DELETE_OID",
375 .flags = 0,
376 .type = LDAPSCHEMA_CONTROL,
377 .def = NULL,
378 .spec = "Microsoft: Open Specifications",
379 .spec_type = LDAPSCHEMA_SPEC_URL,
380 .spec_name = "Open Specifications",
381 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
382 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
383 .spec_vendor = "Microsoft",
384 .spec_text = "The LDAP_SERVER_TREE_DELETE_OID control is used with an"
385 " LDAP delete operation to cause the server to"
386 " recursively delete the entire subtree of objects"
387 " located underneath the object specified in the delete"
388 " operation. The object specified in the delete operation"
389 " is also deleted.\n"
390 "\n"
391 "The server deletes between 1 and 16,384 objects. If the"
392 " server does not delete the entire tree in a single LDAP"
393 " delete request, it MUST NOT delete the root of the tree"
394 " (the object specified in the delete operation), and MUST"
395 " return the error code adminLimitExceeded /"
396 " ERROR_DS_TREE_DELETE_NOT_FINISHED.\n"
397 "\n"
398 "When sending this control to the DC, the controlValue"
399 " field of the Control structure is omitted. Sending this"
400 " control to the DC does not cause the server to include"
401 " any controls in its response.\n",
402 .notes = NULL,
403};
404{
405 .oid = "1.2.840.113556.1.4.1338",
406 .name = "LDAP_SERVER_VERIFY_NAME_OID",
407 .desc = "LDAP_SERVER_VERIFY_NAME_OID",
408 .flags = 0,
409 .type = LDAPSCHEMA_CONTROL,
410 .def = NULL,
411 .spec = "Microsoft: Open Specifications",
412 .spec_type = LDAPSCHEMA_SPEC_URL,
413 .spec_name = "Open Specifications",
414 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
415 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
416 .spec_vendor = "Microsoft",
417 .spec_text = "The LDAP_SERVER_VERIFY_NAME_OID control is used with"
418 " LDAP Add and Modify requests to identify the global"
419 " catalog server (GC server) that is used to verify the"
420 " existence of any objects pointed to by DN attribute"
421 " values (as specified in section 3.1.1.1.6). If the DC"
422 " needs to call a GC server while processing the Add or"
423 " Modify request, it calls the GC server specified in"
424 " this control. If this control is not used, the DC is"
425 " free to call any GC server in the forest.\n",
426 .notes = NULL,
427};
428{
429 .oid = "2.16.840.1.113730.3.4.9",
430 .name = "LDAP_CONTROL_VLVREQUEST",
431 .desc = "LDAP_CONTROL_VLVREQUEST",
432 .flags = 0,
433 .type = LDAPSCHEMA_CONTROL,
434 .def = NULL,
435 .spec = "Microsoft: Open Specifications",
436 .spec_type = LDAPSCHEMA_SPEC_URL,
437 .spec_name = "Open Specifications",
438 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
439 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
440 .spec_vendor = "Microsoft",
441 .spec_text = "The LDAP_CONTROL_VLVREQUEST control is used with an LDAP"
442 " search operation to retrieve a subset of the objects"
443 " that satisfy the search request. This control permits"
444 " the client to specify a particular object (the \"target"
445 " object\") in a sorted set of search results, and to"
446 " request that the server return a specified number of"
447 " objects before and after the target object, in addition"
448 " to the target object itself. \"Before\" and \"after\""
449 " the target object are relative to the sort order of the"
450 " search result set. The server will not return objects"
451 " whose attribute value, used as the sort key, is absent."
452 " This control can only be used if the"
453 " LDAP_SERVER_SORT_OID (section 3.1.1.3.4.1.13) control"
454 " is also specified.\n",
455 .notes = NULL,
456};
457{
458 .oid = "2.16.840.1.113730.3.4.10",
459 .name = "LDAP_CONTROL_VLVRESPONSE",
460 .desc = "LDAP_CONTROL_VLVRESPONSE",
461 .flags = 0,
462 .type = LDAPSCHEMA_CONTROL,
463 .def = NULL,
464 .spec = "Microsoft: Open Specifications",
465 .spec_type = LDAPSCHEMA_SPEC_URL,
466 .spec_name = "Open Specifications",
467 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
468 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
469 .spec_vendor = "Microsoft",
470 .spec_text = "The LDAP_CONTROL_VLVREQUEST control is used with an LDAP"
471 " search operation to retrieve a subset of the objects"
472 " that satisfy the search request. This control permits"
473 " the client to specify a particular object (the \"target"
474 " object\") in a sorted set of search results, and to"
475 " request that the server return a specified number of"
476 " objects before and after the target object, in addition"
477 " to the target object itself. \"Before\" and \"after\""
478 " the target object are relative to the sort order of the"
479 " search result set. The server will not return objects"
480 " whose attribute value, used as the sort key, is absent."
481 " This control can only be used if the"
482 " LDAP_SERVER_SORT_OID (section 3.1.1.3.4.1.13) control"
483 " is also specified.\n",
484 .notes = NULL,
485};
486{
487 .oid = "1.2.840.113556.1.4.1504",
488 .name = "LDAP_SERVER_ASQ_OID",
489 .desc = "LDAP_SERVER_ASQ_OID",
490 .flags = 0,
491 .type = LDAPSCHEMA_CONTROL,
492 .def = NULL,
493 .spec = "Microsoft: Open Specifications",
494 .spec_type = LDAPSCHEMA_SPEC_URL,
495 .spec_name = "Open Specifications",
496 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
497 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
498 .spec_vendor = "Microsoft",
499 .spec_text = "The LDAP_SERVER_ASQ_OID control is used with an LDAP"
500 " search operation. When this control is used, the"
501 " search is not performed against the object specified"
502 " in the search, or the objects located underneath that"
503 " object, but rather against the set of objects named by"
504 " an attribute of Object(DS-DN) syntax that is located"
505 " on the object specified by the base DN of the search"
506 " request. The specific attribute to use to scope the"
507 " search is named in the control. Only searches of base"
508 " object scope can be used with the LDAP_SERVER_ASQ_OID"
509 " control.\n"
510 "\n"
511 "For example, suppose there is an object o and a"
512 " multivalued attribute A of Object(DS-DN) syntax such"
513 " that o.A contains the DNs of objects o1, o2, and o3."
514 " An LDAP base-scope search operation that targets"
515 " object o, with the LDAP_SERVER_ASQ_OID control"
516 " attached and specifying the A attribute, will cause"
517 " the server to perform the search not against object o"
518 " but against objects o1, o2, and o3.\n",
519 .notes = NULL,
520};
521{
522 .oid = "1.2.840.113556.1.4.1852",
523 .name = "LDAP_SERVER_QUOTA_CONTROL_OID",
524 .desc = "LDAP_SERVER_QUOTA_CONTROL_OID",
525 .flags = 0,
526 .type = LDAPSCHEMA_CONTROL,
527 .def = NULL,
528 .spec = "Microsoft: Open Specifications",
529 .spec_type = LDAPSCHEMA_SPEC_URL,
530 .spec_name = "Open Specifications",
531 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
532 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
533 .spec_vendor = "Microsoft",
534 .spec_text = "This control is used with an LDAP search operation to"
535 " retrieve the quota of a user. When used with an LDAP"
536 " search operation that queries the constructed"
537 " attributes msDS-QuotaEffective and msDS-QuotaUsed on"
538 " the msDS-QuotaContainer object, the server will return"
539 " the quota of the user who is specified by the control,"
540 " rather than the quota of the user whom the connection"
541 " is authenticated as.\n"
542 "\n"
543 "If the caller attempts to retrieve the quota of a user"
544 " other than the user whom the caller is authenticated as,"
545 " and the caller does not have the RIGHT_DS_READ_PROPERTY"
546 " right on the Quotas container (described in section"
547 " 6.1.1.4.3), the server returns an empty result set.\n"
548 "\n"
549 "If the caller attempts to retrieve the quota of the user"
550 " whom the caller is authenticated as, and the caller has"
551 " neither the RIGHT_DS_READ_PROPERTY right on the Quotas"
552 " container (described in section 6.1.1.4.3) nor the"
553 " DS-Query-Self-Quota control access right on the Quotas"
554 " container, the server returns an empty result set.\n"
555 "\n"
556 "These access checks are also specified in section"
557 " 3.1.1.4.4.\n",
558 .notes = NULL,
559};
560{
561 .oid = "1.2.840.113556.1.4.802",
562 .name = "LDAP_SERVER_RANGE_OPTION_OID",
563 .desc = "LDAP_SERVER_RANGE_OPTION_OID",
564 .flags = 0,
565 .type = LDAPSCHEMA_CONTROL,
566 .def = NULL,
567 .spec = "Microsoft: Open Specifications",
568 .spec_type = LDAPSCHEMA_SPEC_URL,
569 .spec_name = "Open Specifications",
570 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
571 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
572 .spec_vendor = "Microsoft",
573 .spec_text = "LDAP_SERVER_RANGE_OPTION_OID, unlike the other controls"
574 " discussed in this section, does not actually designate"
575 " an LDAP extended control. Nonetheless, it is included"
576 " in this discussion because its OID is found in the"
577 " supportedControl attribute of the DC's rootDSE. The"
578 " presence of this OID indicates that the DC supports"
579 " range retrieval of multivalued attributes. Range"
580 " retrieval is a mechanism that permits attributes that"
581 " have too many values to be retrieved in a single LDAP"
582 " search request to be retrieved via multiple LDAP"
583 " search requests. Range retrieval is documented in"
584 " section 3.1.1.3.1.3.3.\n"
585 "\n"
586 "Note Although this OID is not present in the"
587 " supportedControl attribute of Windows 2000 operating"
588 " system DCs, such DCs nonetheless support range"
589 " retrieval.\n",
590 .notes = NULL,
591};
592{
593 .oid = "1.2.840.113556.1.4.1907",
594 .name = "LDAP_SERVER_SHUTDOWN_NOTIFY_OID",
595 .desc = "LDAP_SERVER_SHUTDOWN_NOTIFY_OID",
596 .flags = 0,
597 .type = LDAPSCHEMA_CONTROL,
598 .def = NULL,
599 .spec = "Microsoft: Open Specifications",
600 .spec_type = LDAPSCHEMA_SPEC_URL,
601 .spec_name = "Open Specifications",
602 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
603 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
604 .spec_vendor = "Microsoft",
605 .spec_text = "This control is used with an LDAP Search request. The"
606 " Search request has base object scope. The base DN of"
607 " the search is the DN of the DC's nTDSDSA object, and"
608 " the search filter is \"(objectClass=*)\". If the"
609 " application sending the search request is not running"
610 " on the same computer as the DC, the result is the error"
611 " unwillingToPerform / <unrestricted>.\n"
612 "\n"
613 "When sending this control to the DC, the controlValue"
614 " field of the Control structure is omitted. Sending this"
615 " control to the DC does not cause the server to include"
616 " any controls in its response.\n"
617 "\n"
618 "This control is only supported on the Small Business"
619 " Server version of the Windows operating system.\n"
620 "\n"
621 "Because this control only has an effect for applications"
622 " running on the same machine as the DC, the effects of"
623 " this control are not observable on the network. This"
624 " control causes the DC to notify the client when the DC"
625 " is shutting down. When the DC receives a search request"
626 " with this control attached, it does not immediately"
627 " send a response to the request. Instead, it sends the"
628 " SearchResultDone response (see [RFC2251] section 4.5.2)"
629 " to the request when the DC is shutting down.\n",
630 .notes = NULL,
631};
632{
633 .oid = "1.2.840.113556.1.4.1974",
634 .name = "LDAP_SERVER_FORCE_UPDATE_OID",
635 .desc = "LDAP_SERVER_FORCE_UPDATE_OID",
636 .flags = 0,
637 .type = LDAPSCHEMA_CONTROL,
638 .def = NULL,
639 .spec = "Microsoft: Open Specifications",
640 .spec_type = LDAPSCHEMA_SPEC_URL,
641 .spec_name = "Open Specifications",
642 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
643 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
644 .spec_vendor = "Microsoft",
645 .spec_text = "A DC does not perform originating updates that do not"
646 " affect the state of the DC. For example, given an LDAP"
647 " Modify operation that sets the value of an attribute A"
648 " to a value V, if the value of A is already V prior to"
649 " the Modify operation, the DC skips the update and"
650 " returns success. The stamp associated with A is not"
651 " changed, and the Modify operation does not cause"
652 " replication traffic.\n"
653 "\n"
654 "When the LDAP_SERVER_FORCE_UPDATE_OID control is"
655 " attached to an update operation, the DC does not"
656 " perform the optimization described in the previous"
657 " paragraph. The update always generates a new stamp"
658 " for the attribute or link value and always replicates.\n"
659 "\n"
660 "When sending this control to a DC, the controlValue"
661 " field of the Control structure is omitted. Sending this"
662 " control to a DC does not cause the DC to include any"
663 " controls in its response.\n",
664 .notes = NULL,
665};
666{
667 .oid = "1.2.840.113556.1.4.1948",
668 .name = "LDAP_SERVER_RANGE_RETRIEVAL_NOERR_OID",
669 .desc = "LDAP_SERVER_RANGE_RETRIEVAL_NOERR_OID",
670 .flags = 0,
671 .type = LDAPSCHEMA_CONTROL,
672 .def = NULL,
673 .spec = "Microsoft: Open Specifications",
674 .spec_type = LDAPSCHEMA_SPEC_URL,
675 .spec_name = "Open Specifications",
676 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
677 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
678 .spec_vendor = "Microsoft",
679 .spec_text = "This control is used to modify the behavior of a range"
680 " retrieval operation (see section 3.1.1.3.1.3.3). When"
681 " this control is not specified, if range retrieval is"
682 " being performed on an attribute whose values are"
683 " forward link values or back link values, and the value"
684 " of low is greater than or equal to the number of values"
685 " in the attribute, the DC will return the error"
686 " operationsError / <unrestricted>. If this control is"
687 " specified, no error is returned in this case (and no"
688 " values are returned). For example, if an object has a"
689 " member attribute with 500 values, performing the range"
690 " retrieval \"member;range=500-*\" will return"
691 " operationsError / <unrestricted> without this control,"
692 " and success with this control.\n"
693 "\n"
694 "When sending this control to a DC, the controlValue"
695 " field of the Control structure is omitted. Sending this"
696 " control to a DC does not cause the DC to include any"
697 " controls in its response.\n",
698 .notes = NULL,
699};
700{
701 .oid = "1.2.840.113556.1.4.1341",
702 .name = "LDAP_SERVER_RODC_DCPROMO_OID",
703 .desc = "LDAP_SERVER_RODC_DCPROMO_OID",
704 .flags = 0,
705 .type = LDAPSCHEMA_CONTROL,
706 .def = NULL,
707 .spec = "Microsoft: Open Specifications",
708 .spec_type = LDAPSCHEMA_SPEC_URL,
709 .spec_name = "Open Specifications",
710 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
711 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
712 .spec_vendor = "Microsoft",
713 .spec_text = "If this control is specified and the caller does not"
714 " have the DS-Install-Replica control access right on"
715 " the root of the default NC, the result is the error"
716 " insufficientAccessRights / ERROR_ACCESS_DENIED.\n"
717 "\n"
718 "If the request is an Add of an object of class user or"
719 "a subclass of user, the presence of this control has"
720 "the following effects:\n"
721 "\n"
722 " * The DC generates a value in the range [1 .. 65535]"
723 " that is not used as a value of the"
724 " msDS-SecondaryKrbTgtNumber attribute on an object in"
725 " this domain, and assigns the generated value to the"
726 " msDS-SecondaryKrbTgtNumber attribute of the created"
727 " object. If no such value exists, the result is the"
728 " error other / ERROR_NO_SYSTEM_RESOURCES.\n"
729 "\n"
730 " * The generated value for msDS-SecondaryKrbTgtNumber"
731 " is appended (in decimal form) to the string \"krbtgt\","
732 " and the resulting string is assigned to the"
733 " sAMAccountName attribute on the created object.\n"
734 "\n"
735 " * The userAccountControl bits ADS_UF_ACCOUNT_DISABLE"
736 " and ADS_UF_DONT_EXPIRE_PASSWD (section 2.2.16) are set"
737 " on the object's userAccountControl attribute.\n"
738 "\n"
739 " * The object's account password is set to a randomly"
740 " generated value that satisfies all criteria in"
741 " [MS-SAMR] section 3.1.1.7.2 and is processed as"
742 " described in [MS-SAMR] section 3.1.1.8.5.\n"
743 "\n"
744 " Note In Windows Server 2008 operating system and"
745 " later, the DC servicing the request need not be the PDC"
746 " FSMO role owner.\n"
747 "\n"
748 "If the request is an Add of an object of class nTDSDSA,"
749 " the presence of this control has the following effects:\n"
750 "\n"
751 " * The DC creates the nTDSDSA object using the"
752 " information provided in the Add request. The only"
753 " special effect of the control is to perform the"
754 " checking of the DS-Install-Replica control access right"
755 " (specified previously in this section) to authorize the"
756 " nTDSDSA object creation. Without this control, an Add"
757 " that attempts to create an nTDSDSA object will fail"
758 " because the class is system-only (section 3.1.1.2.4.8).\n"
759 "\n"
760 "When sending this control to a DC, the controlValue"
761 " field of the Control structure is omitted. Sending this"
762 " control to a DC does not cause the DC to include any"
763 " controls in its response.\n",
764 .notes = NULL,
765};
766{
767 .oid = "1.2.840.113556.1.4.2026",
768 .name = "LDAP_SERVER_DN_INPUT_OID",
769 .desc = "LDAP_SERVER_DN_INPUT_OID",
770 .flags = 0,
771 .type = LDAPSCHEMA_CONTROL,
772 .def = NULL,
773 .spec = "Microsoft: Open Specifications",
774 .spec_type = LDAPSCHEMA_SPEC_URL,
775 .spec_name = "Open Specifications",
776 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
777 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
778 .spec_vendor = "Microsoft",
779 .spec_text = "This control is used to specify the DN of an object"
780 " during certain LDAP operations.\n"
781 "\n"
782 "When used with an LDAP search operation that queries"
783 " the constructed attribute msDS-IsUserCachableAtRodc on"
784 " a computer object that represents an RODC, the server"
785 " will return the administrative policy regarding whether"
786 " the secret attributes of the security principal"
787 " represented by the DN specified in the control can be"
788 " cached on the RODC. If the caller does not have the"
789 " Read-Only-Replication-Secret-Synchronization control"
790 " access right on the root of the default NC, the error"
791 " operationsError / ERROR_DS_CANT_RETRIEVE_ATTRS is"
792 " returned. This access check is also specified in"
793 " section 3.1.1.4.4.\n",
794 .notes = NULL,
795};
796{
797 .oid = "1.2.840.113556.1.4.2065",
798 .name = "LDAP_SERVER_SHOW_DEACTIVATED_LINK_OID",
799 .desc = "LDAP_SERVER_SHOW_DEACTIVATED_LINK_OID",
800 .flags = 0,
801 .type = LDAPSCHEMA_CONTROL,
802 .def = NULL,
803 .spec = "Microsoft: Open Specifications",
804 .spec_type = LDAPSCHEMA_SPEC_URL,
805 .spec_name = "Open Specifications",
806 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
807 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
808 .spec_vendor = "Microsoft",
809 .spec_text = "The LDAP_SERVER_SHOW_DEACTIVATED_LINK_OID control is"
810 " used with an LDAP search operation to specify that"
811 " link attributes that refer to deleted-objects are"
812 " visible to the search operation. If used in"
813 " conjunction with LDAP_SERVER_SHOW_DELETED_OID or"
814 " LDAP_SERVER_SHOW_RECYCLED_OID, link attributes that"
815 " are stored on deleted-objects are also visible to the"
816 " search operation. This applies to both the search"
817 " filter and the set of attributes returned by the"
818 " search operation. When this control is not used,"
819 " linked attribute values referring to deleted-objects"
820 " and link valued attributes stored on deleted-objects"
821 " are not visible to search operation filters, and are"
822 " not returned as requested attributes for the search"
823 " operation.\n",
824 .notes = NULL,
825};
826{
827 .oid = "1.2.840.113556.1.4.2064",
828 .name = "LDAP_SERVER_SHOW_RECYCLED_OID",
829 .desc = "LDAP_SERVER_SHOW_RECYCLED_OID",
830 .flags = 0,
831 .type = LDAPSCHEMA_CONTROL,
832 .def = NULL,
833 .spec = "Microsoft: Open Specifications",
834 .spec_type = LDAPSCHEMA_SPEC_URL,
835 .spec_name = "Open Specifications",
836 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
837 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
838 .spec_vendor = "Microsoft",
839 .spec_text = "The LDAP_SERVER_SHOW_RECYCLED_OID control is used with"
840 " an LDAP operation to specify that tombstones,"
841 " deleted-objects, and recycled-objects must be visible"
842 " to the operation. For example, when the control is"
843 " used with an LDAP search operation, the search results"
844 " include any tombstones, deleted-objects, or"
845 " recycled-objects that match the search filter.\n",
846 .notes = NULL,
847};
848{
849 .oid = "1.2.840.113556.1.4.2066",
850 .name = "LDAP_SERVER_POLICY_HINTS_DEPRECATED_OID",
851 .desc = "LDAP_SERVER_POLICY_HINTS_DEPRECATED_OID",
852 .flags = 0,
853 .type = LDAPSCHEMA_CONTROL,
854 .def = NULL,
855 .spec = "Microsoft: Open Specifications",
856 .spec_type = LDAPSCHEMA_SPEC_URL,
857 .spec_name = "Open Specifications",
858 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
859 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
860 .spec_vendor = "Microsoft",
861 .spec_text = "The LDAP_SERVER_POLICY_HINTS_DEPRECATED_OID control has"
862 " the exact semantics and behaviors as"
863 " LDAP_SERVER_POLICY_HINTS_OID (section 3.1.1.3.4.1.27);"
864 " this control MAY be used by clients when the server"
865 " does not support LDAP_SERVER_POLICY_HINTS_OID. Clients"
866 " SHOULD use LDAP_SERVER_POLICY_HINTS_OID when it is"
867 " supported by the server\n",
868 .notes = NULL,
869};
870{
871 .oid = "1.2.840.113556.1.4.2090",
872 .name = "LDAP_SERVER_DIRSYNC_EX_OID",
873 .desc = "LDAP_SERVER_DIRSYNC_EX_OID",
874 .flags = 0,
875 .type = LDAPSCHEMA_CONTROL,
876 .def = NULL,
877 .spec = "Microsoft: Open Specifications",
878 .spec_type = LDAPSCHEMA_SPEC_URL,
879 .spec_name = "Open Specifications",
880 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
881 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
882 .spec_vendor = "Microsoft",
883 .spec_text = "The LDAP_SERVER_DIRSYNC_EX_OID control is used with an"
884 " LDAP search operation in exactly the same way as the"
885 " LDAP_SERVER_DIRSYNC_OID control, except for"
886 " differences specified in this section. All ASN.1"
887 " structures and the meaning of the fields of those"
888 " structures are the same.\n"
889 "\n"
890 "As with the LDAP_SERVER_DIRSYNC_OID control, any"
891 " attributes can be requested in the search. Only those"
892 " objects for which these attributes have been created"
893 " or modified since the time represented by Cookie will"
894 " be considered for inclusion in the search. However,"
895 " where the LDAP_SERVER_DIRSYNC_OID control returns only"
896 " those attributes that have changed, the"
897 " LDAP_SERVER_DIRSYNC_EX_OID control also returns"
898 " unchanged attributes when the attribute name in the"
899 " request is appended with the string"
900 " \";dirSyncAlwaysReturn\".\n",
901 .notes = NULL,
902};
903{
904 .oid = "1.2.840.113556.1.4.2205",
905 .name = "LDAP_SERVER_UPDATE_STATS_OID",
906 .desc = "LDAP_SERVER_UPDATE_STATS_OID",
907 .flags = 0,
908 .type = LDAPSCHEMA_CONTROL,
909 .def = NULL,
910 .spec = "Microsoft: Open Specifications",
911 .spec_type = LDAPSCHEMA_SPEC_URL,
912 .spec_name = "Open Specifications",
913 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
914 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
915 .spec_vendor = "Microsoft",
916 .spec_text = "The LDAP_SERVER_UPDATE_STATS_OID control can be used"
917 " with any LDAP operation. When sending this control to"
918 " the DC, the controlValue field of the Control"
919 " structure is omitted.\n"
920 "\n"
921 "When the server receives a request with the"
922 " LDAP_SERVER_UPDATE_STATS_OID control attached to it,"
923 " the server includes a response control in the response"
924 " that contains statistics. The controlType field of the"
925 " returned Control structure is set to the OID of the"
926 " LDAP_SERVER_UPDATE_STATS_OID control. The controlValue"
927 " field is included in the returned Control structure.\n",
928 .notes = NULL,
929};
930{
931 .oid = "1.2.840.113556.1.4.2204",
932 .name = "LDAP_SERVER_TREE_DELETE_EX_OID",
933 .desc = "LDAP_SERVER_TREE_DELETE_EX_OID",
934 .flags = 0,
935 .type = LDAPSCHEMA_CONTROL,
936 .def = NULL,
937 .spec = "Microsoft: Open Specifications",
938 .spec_type = LDAPSCHEMA_SPEC_URL,
939 .spec_name = "Open Specifications",
940 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
941 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
942 .spec_vendor = "Microsoft",
943 .spec_text = "The LDAP_SERVER_TREE_DELETE_EX_OID control is used with"
944 " an LDAP delete operation to cause the server to"
945 " recursively delete the entire subtree of objects"
946 " located underneath the object specified in the delete"
947 " operation. The object specified in the delete operation"
948 " is also deleted.\n",
949 .notes = NULL,
950};
951{
952 .oid = "1.2.840.113556.1.4.2206",
953 .name = "LDAP_SERVER_SEARCH_HINTS_OID",
954 .desc = "LDAP_SERVER_SEARCH_HINTS_OID",
955 .flags = 0,
956 .type = LDAPSCHEMA_CONTROL,
957 .def = NULL,
958 .spec = "Microsoft: Open Specifications",
959 .spec_type = LDAPSCHEMA_SPEC_URL,
960 .spec_name = "Open Specifications",
961 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
962 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
963 .spec_vendor = "Microsoft",
964 .spec_text = "The LDAP_SERVER_SEARCH_HINTS_OID control is used with"
965 " an LDAP search operation. This control supplies hints"
966 " to the search operation on how to satisfy the search.\n",
967 .notes = NULL,
968};
969{
970 .oid = "1.2.840.113556.1.4.2211",
971 .name = "LDAP_SERVER_EXPECTED_ENTRY_COUNT_OID",
972 .desc = "LDAP_SERVER_EXPECTED_ENTRY_COUNT_OID",
973 .flags = 0,
974 .type = LDAPSCHEMA_CONTROL,
975 .def = NULL,
976 .spec = "Microsoft: Open Specifications",
977 .spec_type = LDAPSCHEMA_SPEC_URL,
978 .spec_name = "Open Specifications",
979 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
980 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
981 .spec_vendor = "Microsoft",
982 .spec_text = "The LDAP_SERVER_EXPECTED_ENTRY_COUNT_OID is used with"
983 " an LDAP search operation to potentially modify the"
984 " return code of the operation.\n",
985 .notes = NULL,
986};
987{
988 .oid = "1.2.840.113556.1.4.2239",
989 .name = "LDAP_SERVER_POLICY_HINTS_OID",
990 .desc = "LDAP_SERVER_POLICY_HINTS_OID",
991 .flags = 0,
992 .type = LDAPSCHEMA_CONTROL,
993 .def = NULL,
994 .spec = "Microsoft: Open Specifications",
995 .spec_type = LDAPSCHEMA_SPEC_URL,
996 .spec_name = "Open Specifications",
997 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
998 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
999 .spec_vendor = "Microsoft",
1000 .spec_text = "The LDAP_SERVER_POLICY_HINTS_OID control is used with"
1001 " an LDAP operation to enforce the password history"
1002 " length constraint ([MS-SAMR] section 3.1.1.7.1) during"
1003 " password set. The password history policy sets how"
1004 " frequently old passwords can be reused.\n",
1005 .notes = NULL,
1006};
1007{
1008 .oid = "1.2.840.113556.1.4.2255",
1009 .name = "LDAP_SERVER_SET_OWNER_OID",
1010 .desc = "LDAP_SERVER_SET_OWNER_OID",
1011 .flags = 0,
1012 .type = LDAPSCHEMA_CONTROL,
1013 .def = NULL,
1014 .spec = "Microsoft: Open Specifications",
1015 .spec_type = LDAPSCHEMA_SPEC_URL,
1016 .spec_name = "Open Specifications",
1017 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
1018 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
1019 .spec_vendor = "Microsoft",
1020 .spec_text = "The LDAP_SERVER_SET_OWNER_OID is used with an LDAP add"
1021 " operation to specify the owner of the object to be"
1022 " created. The owner is to be set into the owner portion"
1023 " of the security descriptor stored in the"
1024 " ntSecurityDescriptor attribute of the object to be"
1025 " created.\n",
1026 .notes = NULL,
1027};
1028{
1029 .oid = "1.2.840.113556.1.4.2256",
1030 .name = "LDAP_SERVER_BYPASS_QUOTA_OID",
1031 .desc = "LDAP_SERVER_BYPASS_QUOTA_OID",
1032 .flags = 0,
1033 .type = LDAPSCHEMA_CONTROL,
1034 .def = NULL,
1035 .spec = "Microsoft: Open Specifications",
1036 .spec_type = LDAPSCHEMA_SPEC_URL,
1037 .spec_name = "Open Specifications",
1038 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
1039 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
1040 .spec_vendor = "Microsoft",
1041 .spec_text = "The LDAP_SERVER_BYPASS_QUOTA_OID is used with an LDAP"
1042 " add operation to specify that exceeding quota"
1043 " limitations MUST NOT cause the add to fail. When"
1044 " sending this control to the DC, the controlValue field"
1045 " of the Control structure is omitted. Sending this"
1046 " control to the DC does not cause the server to"
1047 " include any controls in its response.\n",
1048 .notes = NULL,
1049};
1050{
1051 .oid = "1.2.840.113556.1.4.2309",
1052 .name = "LDAP_SERVER_LINK_TTL_OID",
1053 .desc = "LDAP_SERVER_LINK_TTL_OID",
1054 .flags = 0,
1055 .type = LDAPSCHEMA_CONTROL,
1056 .def = NULL,
1057 .spec = "Microsoft: Open Specifications",
1058 .spec_type = LDAPSCHEMA_SPEC_URL,
1059 .spec_name = "Open Specifications",
1060 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
1061 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
1062 .spec_vendor = "Microsoft",
1063 .spec_text = "The LDAP_SERVER_LINK_TTL_OID control is used with an"
1064 " LDAP search request to cause the DC to return TTL-DNs"
1065 " for link values with associated expiry times (see"
1066 " section 3.1.1.9.2).\n"
1067 "\n"
1068 "When sending this control to a DC, the controlValue"
1069 " field is omitted.\n"
1070 "\n"
1071 "Sending this control to the DC does not cause the server"
1072 " to include any controls in its response.\n",
1073 .notes = NULL,
1074};
1075{
1076 .oid = "1.2.840.113556.1.4.2330",
1077 .name = "LDAP_SERVER_SET_CORRELATION_ID_OID",
1078 .desc = "LDAP_SERVER_SET_CORRELATION_ID_OID",
1079 .flags = 0,
1080 .type = LDAPSCHEMA_CONTROL,
1081 .def = NULL,
1082 .spec = "Microsoft: Open Specifications",
1083 .spec_type = LDAPSCHEMA_SPEC_URL,
1084 .spec_name = "Open Specifications",
1085 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
1086 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
1087 .spec_vendor = "Microsoft",
1088 .spec_text = "The LDAP_SERVER_SET_CORRELATION_ID_OID control is used"
1089 " with any LDAP operation to provide an identifier for"
1090 " the operation that the DC can use for"
1091 " implementation-defined troubleshooting. Additionally,"
1092 " the value can be returned to the caller via the"
1093 " LDAP_SERVER_GET_STATS_OID control (section 3.1.1.3.4.1.6).\n"
1094 "\n"
1095 "When sending this control to a DC, the controlValue"
1096 " field MUST contain 16 bytes. If controlValue does not"
1097 " contain 16 bytes and the control is critical, the DC"
1098 " returns the error unavailableCriticalExtension /"
1099 " <unrestricted>.\n"
1100 "\n"
1101 "Sending this control to the DC does not cause the"
1102 " server to include any controls in its response.\n",
1103 .notes = NULL,
1104};
1105{
1106 .oid = "1.2.840.113556.1.4.2354",
1107 .name = "LDAP_SERVER_THREAD_TRACE_OVERRIDE_OID",
1108 .desc = "LDAP_SERVER_THREAD_TRACE_OVERRIDE_OID",
1109 .flags = 0,
1110 .type = LDAPSCHEMA_CONTROL,
1111 .def = NULL,
1112 .spec = "Microsoft: Open Specifications",
1113 .spec_type = LDAPSCHEMA_SPEC_URL,
1114 .spec_name = "Open Specifications",
1115 .spec_section = "3.1.1.3.4.1 LDAP Extended Controls",
1116 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3c5e87db-4728-4f29-b164-01dd7d7391ea",
1117 .spec_vendor = "Microsoft",
1118 .spec_text = "The LDAP_SERVER_THREAD_TRACE_OVERRIDE_OID control is"
1119 " used with any LDAP operation to provide an indication"
1120 " to the DC to perform additional"
1121 " implementation-defined troubleshooting.\n"
1122 "\n"
1123 "When sending this control to a DC, the controlValue"
1124 " field is omitted.\n"
1125 "\n"
1126 "Sending this control to the DC does not cause the"
1127 " server to include any controls in its response.\n",
1128 .notes = NULL,
1129};
1130
1131
1132
1133//
1134// Microsoft: Open Specifications
1135// 3.1.1.3.4.2 LDAP Extended Operations
1136// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3ed61e6c-cfdc-487d-9f02-5a3397be3772
1137//
1138// LDAP extended operations are an extensibility mechanism in version 3 of
1139// LDAP, as discussed in [RFC2251] section 4.12. The following sections
1140// describe the LDAP extended operations that are implemented by DCs in
1141// Windows Server 2003 operating system and later (including Active
1142// Directory Application Mode (ADAM)).
1143//
1144// The LDAP extended operations supported by a DC are exposed as OIDs in the
1145// supportedExtension attribute of the rootDSE. Each OID is mapped to a
1146// human-readable name as shown in the following table.
1147//
1148// Extended operation name | OID
1149// --------------------------------+----------------------------
1150// LDAP_SERVER_FAST_BIND_OID | 1.2.840.113556.1.4.1781
1151// LDAP_SERVER_START_TLS_OID | 1.3.6.1.4.1.1466.20037
1152// LDAP_TTL_REFRESH_OID | 1.3.6.1.4.1.1466.101.119.1
1153// LDAP_SERVER_WHO_AM_I_OID | 1.3.6.1.4.1.4203.1.11.3
1154// LDAP_SERVER_BATCH_REQUEST_OID | 1.2.840.113556.1.4.2212
1155//
1156{
1157 .oid = "1.2.840.113556.1.4.1781",
1158 .name = "LDAP_SERVER_FAST_BIND_OID",
1159 .desc = "LDAP_SERVER_FAST_BIND_OID",
1160 .flags = 0,
1161 .type = LDAPSCHEMA_EXTENSION,
1162 .def = NULL,
1163 .spec = "Microsoft: Open Specifications",
1164 .spec_type = LDAPSCHEMA_SPEC_URL,
1165 .spec_name = "Open Specifications",
1166 .spec_section = "3.1.1.3.4.2 LDAP Extended Operations",
1167 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1168 .spec_vendor = "Microsoft",
1169 .spec_text = "The presence of this OID in the supportedExtension"
1170 " attribute indicates that the DC provides support for"
1171 " fast bind mode. In fast bind mode, the server"
1172 " validates (authenticates) the credentials of LDAP bind"
1173 " requests that are sent on the connection. However,"
1174 " unlike a regular (non–fast bind mode) bind, the DC"
1175 " performs authentication only. The DC does not perform"
1176 " authorization steps, such as computing the group"
1177 " memberships of the authenticated security principal.\n"
1178 "\n"
1179 "The LDAP_SERVER_FAST_BIND_OID operation puts the LDAP"
1180 " connection on which it was sent into fast bind mode on"
1181 " the DC. The server will reject this operation with the"
1182 " error unwillingToPerform / ERROR_DS_UNWILLING_TO_PERFORM"
1183 " if a successful bind has already been performed on the"
1184 " connection.\n"
1185 "\n"
1186 "Note that a client can retrieve the supportedExtension"
1187 " attribute from the root DSE without having first"
1188 " performed a bind (since the supportedExtension"
1189 " attribute is anonymously accessible, and LDAPv3 does"
1190 " not require a bind to be performed for anonymous"
1191 " access). A client MUST NOT specify any control other"
1192 " than LDAP_SERVER_EXTENDED_DN_OID when querying the"
1193 " root DSE anonymously. Thus, a client can determine if"
1194 " the server supports fast bind mode without first"
1195 " having to bind to the server.\n"
1196 "\n"
1197 "Only simple binds are accepted on a connection in this"
1198 " mode. All other types of bind operations are rejected"
1199 " with the error unwillingToPerform /"
1200 " ERROR_DS_INAPPROPRIATE_AUTH. The connection is always"
1201 " treated as if no bind had occurred for the purposes of"
1202 " all other LDAP operations; that is, the connection is"
1203 " treated as the anonymous user (in other words, an"
1204 " anonymous bind).\n"
1205 "\n"
1206 "To send this extended operation to the DC, the client"
1207 " sends an LDAP ExtendedRequest with the requestName"
1208 " field containing the operation's OID. The requestValue"
1209 " field is omitted. The server will return an"
1210 " ExtendedResponse with the responseName field containing"
1211 " the operation's OID and the response field omitted.\n"
1212 "\n"
1213 "The following shows a typical sequence of operations in"
1214 "fast bind:\n"
1215 "\n"
1216 " 1. The client establishes an LDAP connection with the"
1217 " DC.\n"
1218 "\n"
1219 " 2. (Optional) The client checks the"
1220 " supportedExtension attribute on the root DSE to confirm"
1221 " that the DC supports fast bind mode.\n"
1222 "\n"
1223 " 3. The client sends the LDAP_SERVER_FAST_BIND_OID"
1224 " extended operation to the DC to put the LDAP connection"
1225 " into fast bind mode.\n"
1226 "\n"
1227 " 4. The client performs one or more simple binds on"
1228 " the connection.\n",
1229 .notes = NULL,
1230};
1231{
1232 .oid = "1.2.840.113556.1.4.2212",
1233 .name = "LDAP_SERVER_BATCH_REQUEST_OID",
1234 .desc = "LDAP_SERVER_BATCH_REQUEST_OID",
1235 .flags = 0,
1236 .type = LDAPSCHEMA_EXTENSION,
1237 .def = NULL,
1238 .spec = "Microsoft: Open Specifications",
1239 .spec_type = LDAPSCHEMA_SPEC_URL,
1240 .spec_name = "Open Specifications",
1241 .spec_section = "3.1.1.3.4.2 LDAP Extended Operations",
1242 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1243 .spec_vendor = "Microsoft",
1244 .spec_text = "The presence of this OID in the supportedExtension"
1245 " attribute indicates that the DC provides support for"
1246 " the batched LDAP extended operation. In a batched LDAP"
1247 " extended operation, the DC accepts an extended"
1248 " operation that contains a sequence of LDAP messages"
1249 " (that is, LDAP operations) encoded and packed into the"
1250 " operation data and then operates on the individual"
1251 " messages sequentially.\n",
1252 .notes = NULL,
1253};
1254
1255
1256
1257//
1258// Microsoft: Open Specifications
1259// 3.1.1.3.4.3 LDAP Capabilities
1260// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3ed61e6c-cfdc-487d-9f02-5a3397be3772
1261//
1262// The following sections specify the capabilities exposed by DCs on the
1263// supportedCapabilities attribute of the rootDSE. Capabilities are exposed
1264// in that attribute as OIDs, each of which is mapped to a human-readable
1265// name, as shown in the following table.
1266//
1267// Capability name | OID
1268// ------------------------------------------------+-------------------------
1269// LDAP_CAP_ACTIVE_DIRECTORY_OID | 1.2.840.113556.1.4.800
1270// LDAP_CAP_ACTIVE_DIRECTORY_LDAP_INTEG_OID | 1.2.840.113556.1.4.1791
1271// LDAP_CAP_ACTIVE_DIRECTORY_V51_OID | 1.2.840.113556.1.4.1670
1272// LDAP_CAP_ACTIVE_DIRECTORY_ADAM_DIGEST_OID | 1.2.840.113556.1.4.1880
1273// LDAP_CAP_ACTIVE_DIRECTORY_ADAM_OID | 1.2.840.113556.1.4.1851
1274// LDAP_CAP_ACTIVE_DIRECTORY_PARTIAL_SECRETS_OID | 1.2.840.113556.1.4.1920
1275// LDAP_CAP_ACTIVE_DIRECTORY_V60_OID | 1.2.840.113556.1.4.1935
1276// LDAP_CAP_ACTIVE_DIRECTORY_V61_R2_OID | 1.2.840.113556.1.4.2080
1277// LDAP_CAP_ACTIVE_DIRECTORY_W8_OID | 1.2.840.113556.1.4.2237
1278//
1279// Not all applicable Windows Server releases and Active Directory
1280// Application Mode (ADAM) versions support all the LDAP capabilities.
1281//
1282{
1283 .oid = "1.2.840.113556.1.4.800",
1284 .name = "LDAP_CAP_ACTIVE_DIRECTORY_OID",
1285 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_OID",
1286 .flags = 0,
1287 .type = LDAPSCHEMA_FEATURE,
1288 .def = NULL,
1289 .spec = "Microsoft: Open Specifications",
1290 .spec_type = LDAPSCHEMA_SPEC_URL,
1291 .spec_name = "Open Specifications",
1292 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1293 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1294 .spec_vendor = "Microsoft",
1295 .spec_text = "The presence of this capability indicates that the LDAP"
1296 " server is running Active Directory and is running as AD"
1297 " DS.\n",
1298 .notes = NULL,
1299};
1300{
1301 .oid = "1.2.840.113556.1.4.1791",
1302 .name = "LDAP_CAP_ACTIVE_DIRECTORY_LDAP_INTEG_OID",
1303 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_LDAP_INTEG_OID",
1304 .flags = 0,
1305 .type = LDAPSCHEMA_FEATURE,
1306 .def = NULL,
1307 .spec = "Microsoft: Open Specifications",
1308 .spec_type = LDAPSCHEMA_SPEC_URL,
1309 .spec_name = "Open Specifications",
1310 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1311 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1312 .spec_vendor = "Microsoft",
1313 .spec_text = "The presence of this capability indicates that the LDAP"
1314 " server on the DC is capable of signing and sealing on"
1315 " an NTLM authenticated connection, and that the server"
1316 " is capable of performing subsequent binds on a signed"
1317 " or sealed connection.\n",
1318 .notes = NULL,
1319};
1320{
1321 .oid = "1.2.840.113556.1.4.1670",
1322 .name = "LDAP_CAP_ACTIVE_DIRECTORY_V51_OID",
1323 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_V51_OID",
1324 .flags = 0,
1325 .type = LDAPSCHEMA_FEATURE,
1326 .def = NULL,
1327 .spec = "Microsoft: Open Specifications",
1328 .spec_type = LDAPSCHEMA_SPEC_URL,
1329 .spec_name = "Open Specifications",
1330 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1331 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1332 .spec_vendor = "Microsoft",
1333 .spec_text = "On an Active Directory DC operating as AD DS, the"
1334 " presence of this capability indicates that the LDAP"
1335 " server is running at least the Windows Server 2003"
1336 " operating system version of Active Directory.\n"
1337 "\n"
1338 "On an Active Directory DC operating as AD LDS, the"
1339 " presence of this capability indicates that the LDAP"
1340 " server is running at least the Windows Server 2008"
1341 " operating system version of Active Directory.\n",
1342 .notes = NULL,
1343};
1344{
1345 .oid = "1.2.840.113556.1.4.1880",
1346 .name = "LDAP_CAP_ACTIVE_DIRECTORY_ADAM_DIGEST_OID",
1347 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_ADAM_DIGEST_OID",
1348 .flags = 0,
1349 .type = LDAPSCHEMA_FEATURE,
1350 .def = NULL,
1351 .spec = "Microsoft: Open Specifications",
1352 .spec_type = LDAPSCHEMA_SPEC_URL,
1353 .spec_name = "Open Specifications",
1354 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1355 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1356 .spec_vendor = "Microsoft",
1357 .spec_text = "On a DC operating as AD LDS, the presence of this"
1358 " capability indicates that the DC accepts DIGEST-MD5"
1359 " binds for AD LDS security principals (section 5.1.1.5)."
1360 " An AD LDS DC's DIGEST-MD5 bind functionality depends"
1361 " upon the value of the ADAMDisableSSI configurable"
1362 " setting as specified in section 3.1.1.3.4.7.\n",
1363 .notes = NULL,
1364};
1365{
1366 .oid = "1.2.840.113556.1.4.1851",
1367 .name = "LDAP_CAP_ACTIVE_DIRECTORY_ADAM_OID",
1368 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_ADAM_OID",
1369 .flags = 0,
1370 .type = LDAPSCHEMA_FEATURE,
1371 .def = NULL,
1372 .spec = "Microsoft: Open Specifications",
1373 .spec_type = LDAPSCHEMA_SPEC_URL,
1374 .spec_name = "Open Specifications",
1375 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1376 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1377 .spec_vendor = "Microsoft",
1378 .spec_text = "The presence of this capability indicates that the LDAP"
1379 " server is running Active Directory as AD LDS.\n",
1380 .notes = NULL,
1381};
1382{
1383 .oid = "1.2.840.113556.1.4.1920",
1384 .name = "LDAP_CAP_ACTIVE_DIRECTORY_PARTIAL_SECRETS_OID",
1385 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_PARTIAL_SECRETS_OID",
1386 .flags = 0,
1387 .type = LDAPSCHEMA_FEATURE,
1388 .def = NULL,
1389 .spec = "Microsoft: Open Specifications",
1390 .spec_type = LDAPSCHEMA_SPEC_URL,
1391 .spec_name = "Open Specifications",
1392 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1393 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1394 .spec_vendor = "Microsoft",
1395 .spec_text = "On an Active Directory DC operating as AD DS, the"
1396 " presence of this capability indicates that the DC is"
1397 " an RODC.\n",
1398 .notes = NULL,
1399};
1400{
1401 .oid = "1.2.840.113556.1.4.1935",
1402 .name = "LDAP_CAP_ACTIVE_DIRECTORY_V60_OID",
1403 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_V60_OID",
1404 .flags = 0,
1405 .type = LDAPSCHEMA_FEATURE,
1406 .def = NULL,
1407 .spec = "Microsoft: Open Specifications",
1408 .spec_type = LDAPSCHEMA_SPEC_URL,
1409 .spec_name = "Open Specifications",
1410 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1411 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1412 .spec_vendor = "Microsoft",
1413 .spec_text = "The presence of this capability indicates that the LDAP"
1414 " server is running at least the Windows Server 2008"
1415 " operating system version of Active Directory.\n",
1416 .notes = NULL,
1417};
1418{
1419 .oid = "1.2.840.113556.1.4.2080",
1420 .name = "LDAP_CAP_ACTIVE_DIRECTORY_V61_R2_OID",
1421 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_V61_R2_OID",
1422 .flags = 0,
1423 .type = LDAPSCHEMA_FEATURE,
1424 .def = NULL,
1425 .spec = "Microsoft: Open Specifications",
1426 .spec_type = LDAPSCHEMA_SPEC_URL,
1427 .spec_name = "Open Specifications",
1428 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1429 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1430 .spec_vendor = "Microsoft",
1431 .spec_text = "The presence of this capability indicates that the LDAP"
1432 " server is running at least the Windows Server 2008 R2"
1433 " operating system version of Active Directory.\n",
1434 .notes = NULL,
1435};
1436{
1437 .oid = "1.2.840.113556.1.4.2237",
1438 .name = "LDAP_CAP_ACTIVE_DIRECTORY_W8_OID",
1439 .desc = "LDAP_CAP_ACTIVE_DIRECTORY_W8_OID",
1440 .flags = 0,
1441 .type = LDAPSCHEMA_FEATURE,
1442 .def = NULL,
1443 .spec = "Microsoft: Open Specifications",
1444 .spec_type = LDAPSCHEMA_SPEC_URL,
1445 .spec_name = "Open Specifications",
1446 .spec_section = "3.1.1.3.4.3 LDAP Capabilities",
1447 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5030ad4b-6bc6-4929-b2ab-67733269c025",
1448 .spec_vendor = "Microsoft",
1449 .spec_text = "The presence of this capability indicates that the LDAP"
1450 " server is running at least the Windows Server 2012"
1451 " operating system version of Active Directory.\n",
1452 .notes = NULL,
1453};
1454
1455
1456
1457//
1458// Microsoft: Open Specifications
1459// 3.1.1.3.4.4 LDAP Matching Rules (extensibleMatch)
1460// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/4e638665-f466-4597-93c4-12f2ebfabab5
1461//
1462// The following sections describe the matching rules supported by DCs when
1463// performing LDAP search requests. Unlike, for example, extended controls
1464// and extended operations, there is no attribute exposed by the DC that
1465// specifies which matching rules it supports. The identifiers for these
1466// matching rules are used in an extensibleMatch clause in the filter
1467// portion of a SearchRequest, as described in [RFC2251] section 4.5.1.
1468// Matching rules are identified by an OID that corresponds to a
1469// human-readable name, as shown in the following table.
1470//
1471// Capability name | OID
1472// -------------------------------------+-------------------------
1473// LDAP_MATCHING_RULE_BIT_AND | 1.2.840.113556.1.4.803
1474// LDAP_MATCHING_RULE_BIT_OR | 1.2.840.113556.1.4.804
1475// LDAP_MATCHING_RULE_TRANSITIVE_EVAL | 1.2.840.113556.1.4.1941
1476// LDAP_MATCHING_RULE_DN_WITH_DATA | 1.2.840.113556.1.4.2253
1477//
1478{
1479 .oid = "1.2.840.113556.1.4.803",
1480 .name = "LDAP_MATCHING_RULE_BIT_AND",
1481 .desc = "LDAP_MATCHING_RULE_BIT_AND",
1482 .flags = 0,
1483 .type = LDAPSCHEMA_MATCHINGRULE,
1484 .def = NULL,
1485 .spec = "Microsoft: Open Specifications",
1486 .spec_type = LDAPSCHEMA_SPEC_URL,
1487 .spec_name = "Open Specifications",
1488 .spec_section = "3.1.1.3.4.4 LDAP Matching Rules (extensibleMatch)",
1489 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/4e638665-f466-4597-93c4-12f2ebfabab5",
1490 .spec_vendor = "Microsoft",
1491 .spec_text = "This rule is equivalent to a bitwise \"AND\" operation."
1492 " When this matching rule is used as a clause in a query"
1493 " filter, the clause is satisfied only if all the bits"
1494 " set to '1' in the value included in the clause"
1495 " correspond to bits set to '1' in the value stored in"
1496 " the directory.\n",
1497 .notes = NULL,
1498};
1499{
1500 .oid = "1.2.840.113556.1.4.804",
1501 .name = "LDAP_MATCHING_RULE_BIT_OR",
1502 .desc = "LDAP_MATCHING_RULE_BIT_OR",
1503 .flags = 0,
1504 .type = LDAPSCHEMA_MATCHINGRULE,
1505 .def = NULL,
1506 .spec = "Microsoft: Open Specifications",
1507 .spec_type = LDAPSCHEMA_SPEC_URL,
1508 .spec_name = "Open Specifications",
1509 .spec_section = "3.1.1.3.4.4 LDAP Matching Rules (extensibleMatch)",
1510 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/4e638665-f466-4597-93c4-12f2ebfabab5",
1511 .spec_vendor = "Microsoft",
1512 .spec_text = "This rule is equivalent to a bitwise \"OR\" operation."
1513 " When this matching rule is used as a clause in a query"
1514 " filter, the clause is satisfied only if at least one of"
1515 " the bits set to '1' in the value included in the clause"
1516 " corresponds to a bit set to '1' in the value stored in"
1517 " the directory.\n",
1518 .notes = NULL,
1519};
1520{
1521 .oid = "1.2.840.113556.1.4.1941",
1522 .name = "LDAP_MATCHING_RULE_TRANSITIVE_EVAL",
1523 .desc = "LDAP_MATCHING_RULE_TRANSITIVE_EVAL",
1524 .flags = 0,
1525 .type = LDAPSCHEMA_MATCHINGRULE,
1526 .def = NULL,
1527 .spec = "Microsoft: Open Specifications",
1528 .spec_type = LDAPSCHEMA_SPEC_URL,
1529 .spec_name = "Open Specifications",
1530 .spec_section = "3.1.1.3.4.4 LDAP Matching Rules (extensibleMatch)",
1531 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/4e638665-f466-4597-93c4-12f2ebfabab5",
1532 .spec_vendor = "Microsoft",
1533 .spec_text = "This rule provides recursive search of a link attribute."
1534 " A filter F of the form \"(A: 1.2.840.113556.1.4.1941:=V)\","
1535 " where A is a link attribute and V is a value, evaluates to"
1536 " True for an object whose DN is D if the following method"
1537 " EvalTransitiveFilter(A, V, D) returns true, and False"
1538 " if the method returns false. If A is not a link"
1539 " attribute, the filter F evaluates to Undefined.\n"
1540 "\n"
1541 "EvalTransitiveFilter(A: attribute, V: value, D: DN)\n"
1542 "\n"
1543 " * If A is of Object(DN-String), Object(DN-Binary),"
1544 " Object(OR-Name), or Object(Access-Point) syntax, let V'"
1545 " equal the object_DN portion of V. Otherwise, let V'"
1546 " equal V\n"
1547 "\n"
1548 " * Return the value of EvalTransitiveFilterHelper(A,"
1549 " V', D, {})\n"
1550 "\n"
1551 "EvalTransitiveFilterHelper(A: attribute, V': value,"
1552 " ToVisit: DN, Visited: SET OF DN)\n"
1553 "\n"
1554 " * If A is of Object(DN-String), Object(DN-Binary),"
1555 " Object(OR-Name), or Object(Access-Point) syntax, let C"
1556 " be the set of the object_DN components of the values"
1557 " of ToVisit.A. Otherwise, let C be the set of the"
1558 " values of ToVisit.A. Note that C is a set of DNs.\n"
1559 "\n"
1560 " * If V' is in C, return true.\n"
1561 "\n"
1562 " * Let Visited' equal the Visited set plus {ToVisit}.\n"
1563 "\n"
1564 " * For each DN NextToVisit in C\n"
1565 "\n"
1566 " - If NextToVisit is in Visited, do nothing.\n"
1567 "\n"
1568 " - Let Result = EvalTransitiveFilterHelper(A, V', NextToVisit, Visited')\n"
1569 "\n"
1570 " - If Result is true, return true.\n"
1571 "\n"
1572 " * Return false.\n",
1573 .notes = NULL,
1574};
1575{
1576 .oid = "1.2.840.113556.1.4.2253",
1577 .name = "LDAP_MATCHING_RULE_DN_WITH_DATA",
1578 .desc = "LDAP_MATCHING_RULE_DN_WITH_DATA",
1579 .flags = 0,
1580 .type = LDAPSCHEMA_MATCHINGRULE,
1581 .def = NULL,
1582 .spec = "Microsoft: Open Specifications",
1583 .spec_type = LDAPSCHEMA_SPEC_URL,
1584 .spec_name = "Open Specifications",
1585 .spec_section = "3.1.1.3.4.4 LDAP Matching Rules (extensibleMatch)",
1586 .spec_source = "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/4e638665-f466-4597-93c4-12f2ebfabab5",
1587 .spec_vendor = "Microsoft",
1588 .spec_text = "This rule provides a way to match on portions of values"
1589 " of syntax Object(DN-String) and Object(DN-Binary).\n"
1590 "\n"
1591 "Let F be a filter of the form \"(A: 1.2.840.113556.1.4.2253:=V)\","
1592 " where A is a link attribute and V is a value of syntax"
1593 " Object(DN-String) (section 3.1.1.2.2.2.1) or"
1594 " Object(DN-Binary) (section 3.1.1.2.2.2.3). This filter"
1595 " evaluates to True for an object whose DN is D if the"
1596 " method defined below, EvalDNWithDataFilter(A,V,D),"
1597 " returns true, and False if the method returns false."
1598 " If A is not of syntax Object(DN-String) or"
1599 " Object(DN-Binary), the filter F evaluates to Undefined.\n"
1600 "\n"
1601 "EvalDNWithDataFilter(A: attribute, V: value, D: DN)\n"
1602 "\n"
1603 " * For either syntax, let O be the DN portion of the"
1604 " value V and B be the string or binary portion of the"
1605 " value V. If the attribute is of syntax"
1606 " Object(DN-String), B is the value of the string"
1607 " considered strictly as the sequence of bytes of the"
1608 " string. Note that O can be the rootDSE. Note also that"
1609 " B can have 0 length.\n"
1610 "\n"
1611 " * For every V' where V' is a value of attribute A on"
1612 " object D:\n"
1613 "\n"
1614 " - Let O' be the DN portion of value V' and let B'"
1615 " be the string or binary portion of the value V'.\n"
1616 "\n"
1617 " - If O is not equal to O' and O is not equal to"
1618 " the rootDSE, continue processing other values of V'.\n"
1619 "\n"
1620 " - If B is not equal to the initial bytes of B',"
1621 " continue processing other values of V'. Note"
1622 " especially that only byte values are used in this"
1623 " comparison. No special handling of B as a string is"
1624 " performed (for example, no case-insensitivity, locale"
1625 " specific comparisons, etc.).\n"
1626 "\n"
1627 " - Return true.\n"
1628 "\n"
1629 " * If this method does not return true, it returns false.\n",
1630 .notes = NULL,
1631};
1632
1633
1634
1635// end of OID spec file