Subject: Protocol: MUST provide supportedVersion

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 22 Oct 2003 21:04:43 -0600

Kurt wrote:
>>   Clients may determine the protocol versions a server supports by 
>>   reading the supportedLDAPVersion attribute from the root DSE 
>>   [Models]. Servers which implement version 3 or later MUST provide

>>   this attribute. 
>
>Drop the MUST.  As the returned contents of the root DSE may be     
>subject to ACLs, clients need to deal with the case where an LDAPv3   
  
>server does not provide a root DSE or does not provide this
attribute.
>Most clients simply do blind (e.g., no root DSE checks) LDAPv3 binds
>instead.

This imperative has been here all along. I worry that there are clients
that already rely on this MUST in order to discover the protocol
version, rather than using the Bind/failover method.
 
Jim

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 22 Oct 2003 21:24:45 -0700

>I worry that there are clients that already rely on this MUST in order to discover the protocol version, rather than using the Bind/failover method.

RFC 2251 didn't say supportedLDAPversion **always** had to be
provided when requested.  RFC 2251 allowed:
        servers to require binding before searching
        servers to require start tls before searching
        servers to subject returned attributes to ACLS
                (including, specifically, root DSE attributes)
        etc.

and, hence, implicitly required clients deal with these cases.

A client which doesn't will run into interoperability problems. 
Access controls upon the root DSE are common. Administrative
restrictions requiring bind before search are fairly common.
Administrative restrictions requiring startTLS before search
are fairly common.  Etc..

If we accept the argument that a "MUST provide" is necessary for interoperability, then we not only keep the MUST be we must
disallow the RFC 2251 allowed behaviors listed above. 

If we reject the argument, then just need to drop the MUST.
It might be appropriate to clarify again that search returns
are subject to all kinds of administrative policies, but I think
we've covered that repeatedly.

Kurt