AES bind control

Edit online

The AES bind control explains its use with the server and provides the results.

Description
This control enables the directory server to send updates to the consumer server with passwords already encrypted by using AES. If the consumer server does not support AES encryption of passwords, or the seed or salt values do not match, the directory server decrypts the userpassword and secretkey values in updates to be replicated.
Note: This control is always enabled.
OID
1.3.18.0.2.10.28
Syntax
This control has no value.
Behavior

The criticality must be set to TRUE to protect clients from submitting a request with an unauthorized identity.

This control can operate independent of other controls. However, it is often sent with the Proxy Authorization Control. This control is registered for the following operations:
  • Bind
The following persons are enabled to send the control:
  • Primary Directory Administrator
  • Master Server DN
  • Local Administration Group members
  • Global Administration Group members
Note: If the control is sent by a user who does not have access, LDAP_INSUFFICIENT_ACCESS is returned.
This control has the possible return code as LDAP_INSUFFICIENT_ACCESS. This control is not supported by the Administration Server.
Scope
The control lasts for the life of the bind session to allow for multiple write operations.

The use of the control implies that cryptographic consistency is verified by the caller. At bind time the presence of this control, along with the appropriate authorization, causes the c_isConsistent flag in the connection structure to be set to TRUE. This setting causes any write operations that contain pre-encrypted AES data to be accepted by the server. Without the presence of the control, the connection flag is set to FALSE, and a write operation of this type is rejected by the server. The RDBM back-end is the only back-end that sets, and evaluates, the c_isConsistent flag.