directory-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Apache Wiki <wikidi...@apache.org>
Subject [Directory Wiki] Update of "LdapCodec" by CKoppelt
Date Tue, 06 Feb 2007 22:15:10 GMT
Dear Wiki user,

You have subscribed to a wiki page or wiki category on "Directory Wiki" for change notification.

The following page has been changed by CKoppelt:
http://wiki.apache.org/directory/LdapCodec

The comment on the change is:
moved to cwiki

------------------------------------------------------------------------------
+ deleted
- = LDAP ASN.1 codec =
- [[TableOfContents]]
  
- == LDAP ASN.1 Grammar ==
- 
- The LDAP ASN.1 Grammar is described in RFC 2251. Here is the grammar :
- 
- {{{
-         LDAP-V3 DEFINITIONS
-         IMPLICIT TAGS ::= --pragma {packagePrefix: "ldapd.common.ber"}
- 
-         BEGIN
- 
-         LDAPMessage ::= SEQUENCE {
-                 messageID       MessageID,
-                 protocolOp      CHOICE {
-                         bindRequest     BindRequest,
-                         bindResponse    BindResponse,
-                         unbindRequest   UnbindRequest,
-                         searchRequest   SearchRequest,
-                         searchResEntry  SearchResultEntry,
-                         searchResDone   SearchResultDone,
-                         searchResRef    SearchResultReference,
-                         modifyRequest   ModifyRequest,
-                         modifyResponse  ModifyResponse,
-                         addRequest      AddRequest,
-                         addResponse     AddResponse,
-                         delRequest      DelRequest,
-                         delResponse     DelResponse,
-                         modDNRequest    ModifyDNRequest,
-                         modDNResponse   ModifyDNResponse,
-                         compareRequest  CompareRequest,
-                         compareResponse CompareResponse,
-                         abandonRequest  AbandonRequest,
-                         extendedReq     ExtendedRequest,
-                         extendedResp    ExtendedResponse },
-                  controls       [0] Controls OPTIONAL }
- 
-         MessageID ::= INTEGER (0 .. maxInt)
- 
-         maxInt INTEGER ::= 2147483647 -- (2^^31 - 1) --
- 
-         LDAPString ::= OCTET STRING
- 
-         LDAPOID ::= OCTET STRING
- 
-         LDAPDN ::= LDAPString
- 
-         RelativeLDAPDN ::= LDAPString
- 
-         AttributeType ::= LDAPString
- 
-         AttributeDescription ::= LDAPString
- 
-         AttributeDescriptionList ::= SEQUENCE OF
-                 AttributeDescription
- 
-         AttributeValue ::= OCTET STRING
- 
-         AttributeValueAssertion ::= SEQUENCE {
-                 attributeDesc   AttributeDescription,
-                 assertionValue  AssertionValue }
- 
-         AssertionValue ::= OCTET STRING
- 
-         Attribute ::= SEQUENCE {
-                 type    AttributeDescription,
-                 vals    SET OF AttributeValue }
- 
-         MatchingRuleId ::= LDAPString
- 
-         LDAPResult ::= SEQUENCE {
-                 resultCode      ENUMERATED {
-                              success                      (0),
-                              operationsError              (1),
-                              protocolError                (2),
-                              timeLimitExceeded            (3),
-                              sizeLimitExceeded            (4),
-                              compareFalse                 (5),
-                              compareTrue                  (6),
-                              authMethodNotSupported       (7),
-                              strongAuthRequired           (8),
-                                         -- 9 reserved --
-                              referral                     (10),  -- new
-                              adminLimitExceeded           (11),  -- new
-                              unavailableCriticalExtension (12),  -- new
-                              confidentialityRequired      (13),  -- new
-                              saslBindInProgress           (14),  -- new
-                              noSuchAttribute              (16),
-                              undefinedAttributeType       (17),
-                              inappropriateMatching        (18),
-                              constraintViolation          (19),
-                              attributeOrValueExists       (20),
-                              invalidAttributeSyntax       (21),
-                                         -- 22-31 unused --
-                              noSuchObject                 (32),
-                              aliasProblem                 (33),
-                              invalidDNSyntax              (34),
-                              -- 35 reserved for undefined isLeaf --
-                              aliasDereferencingProblem    (36),
-                                         -- 37-47 unused --
-                              inappropriateAuthentication  (48),
-                              invalidCredentials           (49),
-                              insufficientAccessRights     (50),
-                              busy                         (51),
-                              unavailable                  (52),
-                              unwillingToPerform           (53),
-                              loopDetect                   (54),
-                                         -- 55-63 unused --
-                              namingViolation              (64),
-                              objectClassViolation         (65),
-                              notAllowedOnNonLeaf          (66),
-                              notAllowedOnRDN              (67),
-                              entryAlreadyExists           (68),
-                              objectClassModsProhibited    (69),
-                                         -- 70 reserved for CLDAP --
-                              affectsMultipleDSAs          (71), -- new
-                                         -- 72-79 unused --
-                              other                        (80) },
-                              -- 81-90 reserved for APIs --
-                 matchedDN       LDAPDN,
-                 errorMessage    LDAPString,
-                 referral        [3] Referral OPTIONAL }
- 
-         Referral ::= SEQUENCE OF LDAPURL
- 
-         LDAPURL ::= LDAPString -- limited to characters permitted in URLs
- 
-         Controls ::= SEQUENCE OF Control
- 
-         Control ::= SEQUENCE {
-                 controlType             LDAPOID,
-                 criticality             BOOLEAN DEFAULT FALSE,
-                 controlValue            OCTET STRING OPTIONAL }
- 
-         BindRequest ::= [APPLICATION 0] SEQUENCE {
-                 version                 INTEGER (1 .. 127),
-                 name                    LDAPDN,
-                 authentication          AuthenticationChoice }
- 
-         AuthenticationChoice ::= CHOICE {
-                 simple                  [0] OCTET STRING,
-                                          -- 1 and 2 reserved
-                 sasl                    [3] SaslCredentials }
- 
-         SaslCredentials ::= SEQUENCE {
-                 mechanism               LDAPString,
-                 credentials             OCTET STRING OPTIONAL }
- 
-         BindResponse ::= [APPLICATION 1] SEQUENCE {
- 
-              COMPONENTS OF LDAPResult,
-              serverSaslCreds    [7] OCTET STRING OPTIONAL }
- 
-         UnbindRequest ::= [APPLICATION 2] NULL
- 
-         SearchRequest ::= [APPLICATION 3] SEQUENCE {
-                 baseObject      LDAPDN,
-                 scope           ENUMERATED {
-                         baseObject              (0),
-                         singleLevel             (1),
-                         wholeSubtree            (2) },
-                 derefAliases    ENUMERATED {
-                         neverDerefAliases       (0),
-                         derefInSearching        (1),
-                         derefFindingBaseObj     (2),
-                         derefAlways             (3) },
-                 sizeLimit       INTEGER (0 .. maxInt),
-                 timeLimit       INTEGER (0 .. maxInt),
-                 typesOnly       BOOLEAN,
-                 filter          Filter,
-                 attributes      AttributeDescriptionList }
- }}}{{{
-         Filter ::= CHOICE {
-                 and             [0] SET OF Filter,
-                 or              [1] SET OF Filter,
-                 not             [2] Filter,
-                 equalityMatch   [3] AttributeValueAssertion,
-                 substrings      [4] SubstringFilter,
-                 greaterOrEqual  [5] AttributeValueAssertion,
-                 lessOrEqual     [6] AttributeValueAssertion,
-                 present         [7] AttributeDescription,
-                 approxMatch     [8] AttributeValueAssertion,
-                 extensibleMatch [9] MatchingRuleAssertion }
- 
-         SubstringFilter ::= SEQUENCE {
-                 type            AttributeDescription,
-                 -- at least one must be present
-                 substrings      SEQUENCE OF CHOICE {
-                         initial [0] LDAPString,
-                         any     [1] LDAPString,
-                         final   [2] LDAPString } }
- 
-         MatchingRuleAssertion ::= SEQUENCE {
-                 matchingRule    [1] MatchingRuleId OPTIONAL,
-                 type            [2] AttributeDescription OPTIONAL,
-                 matchValue      [3] AssertionValue,
-                 dnAttributes    [4] BOOLEAN DEFAULT FALSE }
- 
-         SearchResultEntry ::= [APPLICATION 4] SEQUENCE {
-                 objectName      LDAPDN,
-                 attributes      PartialAttributeList }
- 
-         PartialAttributeList ::= SEQUENCE OF SEQUENCE {
-                 type    AttributeDescription,
-                 vals    SET OF AttributeValue }
- 
-         SearchResultReference ::= [APPLICATION 19] SEQUENCE OF LDAPURL
- 
-         SearchResultDone ::= [APPLICATION 5] LDAPResult
- 
-         ModifyRequest ::= [APPLICATION 6] SEQUENCE {
-                 object          LDAPDN,
-                 modification    SEQUENCE OF SEQUENCE {
-                         operation       ENUMERATED {
-                                                 add     (0),
-                                                 delete  (1),
-                                                 replace (2) },
-                         modification    AttributeTypeAndValues } }
- 
-         AttributeTypeAndValues ::= SEQUENCE {
-                 type    AttributeDescription,
-                 vals    SET OF AttributeValue }
- 
-         ModifyResponse ::= [APPLICATION 7] LDAPResult
- 
-         AddRequest ::= [APPLICATION 8] SEQUENCE {
-                 entry           LDAPDN,
-                 attributes      AttributeList }
- 
-         AttributeList ::= SEQUENCE OF SEQUENCE {
-                 type    AttributeDescription,
-                 vals    SET OF AttributeValue }
- 
-         AddResponse ::= [APPLICATION 9] LDAPResult
- 
-         DelRequest ::= [APPLICATION 10] LDAPDN
- 
-         DelResponse ::= [APPLICATION 11] LDAPResult
- 
-         ModifyDNRequest ::= [APPLICATION 12] SEQUENCE {
-                 entry           LDAPDN,
-                 newrdn          RelativeLDAPDN,
-                 deleteoldrdn    BOOLEAN,
-                 newSuperior     [0] LDAPDN OPTIONAL }
- 
-         ModifyDNResponse ::= [APPLICATION 13] LDAPResult
- 
-         CompareRequest ::= [APPLICATION 14] SEQUENCE {
-                 entry           LDAPDN,
-                 ava             AttributeValueAssertion }
- 
-         CompareResponse ::= [APPLICATION 15] LDAPResult
- 
-         AbandonRequest ::= [APPLICATION 16] MessageID
- 
-         ExtendedRequest ::= [APPLICATION 23] SEQUENCE {
-                 requestName      [0] LDAPOID,
-                 requestValue     [1] OCTET STRING OPTIONAL }
- 
-         ExtendedResponse ::= [APPLICATION 24] SEQUENCE {
-                 COMPONENTS OF LDAPResult,
-                 responseName     [10] LDAPOID OPTIONAL,
-                 response         [11] OCTET STRING OPTIONAL }
- 
-         END
- }}}
- 
- 
- As one can see, it's much more complicated than the SPNEGO grammar ! The used encoding is
a subset of BER, where the TRUE value is always encoded as 0xFF and where all length are fully
definite.
- 
- == Decoding an LDAP message ==
- 
- === LdapMessage ===
- Each LDAP message [LdapMessage] starts with a first automate :
- 
- attachment:LdapMessage.png
- 
- === ProtocolOp ===
- The next part (''protocol``Op'') will contains all the different type of possible messages.
:
- 
- attachment:protocolOp.png
- 
- Each message is described in the next chapters.
- 
- === Controls ===
- It can be followed by an optionnal control part, which automaton state is  shown below :
- 
- attachment:Controls.png
- 
- Those two states automaton will be implemented as a Grammar instance, which will be processed
for each LdapMessage we will receive. When we will know which kind of Message we have to deal
with, a new Grammar will be loaded and processed (a Bind``Request grammar, or a Bind``Response...).
If the specific message is correctly decoded, we may have to load the Controls grammar. So
the engine switch from grammar to grammar depending on which part it is decoding. This is
implemented by a Grammar stack which is stored in the decoder Container.
- 
- === LdapResult ===
- 
- Many Ldap``Message while return a result. A specific sub-diagram is dedicated to this Ldap``Result
:
- 
- attachment:LdapResult.png
- 
- We have a specific Grammar to process this LdapResult.
- 
- === BindRequest ===
- 
- The Bind``Request Ldap Message state diagram is shown below :
- 
- 
- attachment:BindRequest.png
- 
- The decoding of a Bind``Request message is simple, as we just need to build an engine that
walks through the state automaton, checking at each state that the next transition is valid,
and execute the associated action. In the real world, it's a little bit more complicated,
because states are not those that we have in the pictures. We have to split each 'state' to
sub-states : one sub-state for the '''Type''', one sub-state for the '''Length''' and another
one for the '''Value''', if necessary. 
- 
- Those sub-states are just usefull to stop the decoding if anything goes wrong (for instance,
if an inner PDU '''Length''' is above its encapsulating PDU).
- 
- But basically, it's the way the decoder works.
- 
- It is also able to stop in the middle of a PDU and start again when the missing data arrive
(of course, there must be an action from the caller !).
- 
- === BindResponse ===
- 
- The Ldap Bind``Response message is also made up of four elements : a ''Ldap``Message'',
the ''Bind``Response'', a ''Ldap``Result'' element and optionnaly a final ''Controls''. Here
is the inner ''Bind``Response'' element :
- 
- attachment:BindResponse.png
- 
- === UnBindRequest ===
- 
- This is the simplest automate! It is fully described in the protocol``OP schema.
- 
- attachment:UnBindRequest.png
- 
- === AbandonRequest  ===
- 
- This LDAP message is sent by a user when he want the current operation to abort (if a search
request take too long, for instance).
- 
- This request just send the Message id which has to be stopped.
- 
- attachment:AbandonRequest.png
- 
- === SearchRequest ===
- 
- The heart of LDAP. Search request are quite complicated, as LDAP is mainly used to search
information. We will use four different automatons to express this part of the LDAP grammar
:
- 
- attachment:SearchRequest.png
- 
- ==== Filter ====
- We can use filters to select elements :
- 
- attachment:Filter.png
- 
- ===== SubstringFilter =====
- attachment:SubstringFilter.png
- 
- ===== MatchingRuleAssertion =====
- attachment:MatchingRuleAssertion.png
- 
- === Search responses ===
- 
- We may have three different kind of responses to a ldap Search. The first two are entries
or references, and the last one is returned when all teh entries or references have been sent.
- 
- ==== SearchResultEntry ====
- attachment:SearchResultEntry.png
- 
- ==== SearchResultReference ====
- 
- attachment:SearchResultReference.png
- 
- ==== SearchResultDone ====
- 
- attachment:SearchResultDone.png
- 
- === Add ===
- 
- We can add an entry. Here is the message to send, and the response you get :
- 
- ==== AddRequest ====
- attachment:AddRequest.png
- 
- ==== AddResponse ====
- attachment:AddResponse.png
- 
- === Del ===
- 
- We can delete an entry. Here is the message to send, and the response you get :
- 
- ==== DelRequest ====
- attachment:DelRequest.png
- 
- ==== DelResponse ====
- attachment:DelResponse.png
- 
- === Modify ===
- 
- We can modify an entry. Here is the message to send, and the response you get :
- 
- ==== ModifyRequest ====
- attachment:ModifyRequest.png
- 
- ==== ModifyResponse ====
- attachment:ModifyResponse.png
- 
- === Modify DN ===
- 
- We can modify a DN. Here is the message to send, and the response you get :
- 
- ==== ModifyDNRequest ====
- attachment:ModifyDNRequest.png
- 
- ==== ModifyDNResponse ====
- attachment:ModifyDNResponse.png
- 
- === Extended message ===
- 
- Otherwise, as LDAP accepts extension, it does through those two messages :
- 
- ==== ExtendedRequest ====
- attachment:ExtendedRequest.png
- 
- ==== ExtendedResponse ====
- attachment:ExtendedResponse.png
- 

Mime
View raw message