Active Directory Cookbook

4.3. Using LDAP Controls

Problem

You want to use an LDAP control as part of an LDAP operation.

Solution

Using a graphical user interface

1. Open LDP.

2. From the menu, select Options → Controls.

3. For the Windows Server 2003 version of LDP, select the control you want to use under Load Predefined. The control should automatically be added to the list of Active Controls.

   For the Windows 2000 version of LDP, you’ll need to type the object identifier (OID) of the control under Object Identifier.

4. Enter the value for the control under Value.

5. Select whether the control is server- or client-side under Control Type.

6. Check the box beside Critical if the control is critical.

7. Click the Check-in button.

8. Click OK.

9. At this point, you will need to invoke the LDAP operation (for example, Search) that will use the control. In the dialog box for any operation, be sure that the “Extended” option is checked before initiating the operation.

Using VBScript

None of the ADSI automation interfaces directly expose LDAP controls. That means they cannot be utilized from VBScript. On the other hand, many of the controls, such as paged searching or deleting a subtree, are wrapped within their own ADSI methods that can be used within VBScript.

Any LDAP-based API, such as the Perl Net::LDAP modules, can be used to set controls as part of LDAP operations.

Discussion

LDAP controls were defined in the LDAPv3 specification as a way to extend LDAP and its operations without breaking the protocol. Many controls have been implemented, some of ...