The LDAP API library sets this result code when the ldap_parse_result() function is called to retrieve the result code of an operation, and additional result codes from the server are available in the LDAP structure.

LDAP_NAMING_VIOLATION

This result code indicates that the request violates the structure of the DIT.

Currently, the Netscape Directory Server does not send this result code back to LDAP clients.

LDAP_NO_MEMORY

This result code indicates that no memory is available.

The LDAP API library sets this result code if a function cannot allocate memory (for example, when creating an LDAP request or an LDAP control).

LDAP_NO_OBJECT_CLASS_MODS

This result code indicates that the request is attempting to modify the object class that should not be modified (for example, a structural object class).

Currently, the Netscape Directory Server does not send this result code back to LDAP clients.

LDAP_NO_RESULTS_RETURNED

This result code indicates that no results were returned from the server.

The LDAP API library sets this result code when the ldap_parse_result() function is called but no result code is included in the server's response.

LDAP_NO_SUCH_ATTRIBUTE

This result code indicates that the specified attribute does not exist in the entry.

The Netscape Directory Server might send this result code back to the client if, for example, a modify request specifies the modification or removal of a non-existent attribute or if a compare request specifies a non-existent attribute.

LDAP_NO_SUCH_OBJECT

This result code indicates that the server cannot find an entry specified in the request.

The Netscape Directory Server sends this result code back to the client if it cannot find a requested entry and if it cannot refer your client to another LDAP server.

LDAP_NOT_ALLOWED_ON_NONLEAF

This result code indicates that the requested operation is allowed only on entries that do not have child entries (entries that are "leaf" entries, as opposed to "branch" entries).

The Netscape Directory Server sends this result code back to the client if the request is a delete request or a modify DN request and the entry is a parent entry. (You cannot delete or move a branch of entries in a single operation.)

LDAP_NOT_ALLOWED_ON_RDN

This result code indicates that the requested operation will affect the RDN of the entry.

The Netscape Directory Server sends this result code back to the client if the request is a modify request and the request deletes attribute values from the entry that are used in the RDN of the entry. (For example, if the DN is "uid=bjensen,ou=People,o=Airius.com", the request removes the attribute value "uid=bjensen" from the entry.)

LDAP_NOT_SUPPORTED

This result code indicates that the LDAP client is attempting to use functionality that is not supported.

The LDAP API library sets this result code if the client identifies itself as an LDAP v2 client, and the client is attempting to use functionality available in LDAP v3. For example:

You are passing LDAP controls to a function.

You are calling ldap_extended_operation(), ldap_extended_operation_s(), or ldap_parse_extended_result() to request an extended operation or to parse an extended response.

You are calling ldap_rename() or ldap_rename_s(), and you are specifying a new "superior DN" as an argument.

You are calling ldap_sasl_bind(), ldap_sasl_bind_s(), or ldap_parse_sasl_bind_result() to request SASL authentication or to parse a SASL bind response.

You are calling ldap_parse_virtuallist_control() to parse a virtual list control from the server's response.

If you want to use these features, make sure to specify that your LDAP client is an LDAP v3 client. For instructions, see "Specifying the LDAP Version of Your Client."

LDAP_OBJECT_CLASS_VIOLATION

This result code indicates that the request specifies a change to an entry or a new entry that does not comply with the server's schema.

The Netscape Directory Server sends this result code back to the client in the following situations:

The request is an add request, and the new entry does not comply with the schema. (For example, the new entry does not have all the required attributes, or the entry has attributes that are not allowed in the entry.)

The request is a modify request, and the change will make the entry noncompliant with the schema. (For example, the change removes a required attribute or adds an attribute that is not allowed.)

Check the server error logs for more information, and check the schema for the type of entry that you are adding or modifying. For more information on the server's schema, see the Netscape Directory Server Administrator's Guide.

LDAP_OPERATIONS_ERROR

This is a general result code indicating that an error has occurred.

The Netscape Directory Server might send this code if, for example, memory cannot be allocated on the server.

To troubleshoot this type of error, check the server's error logs. You may need to increase the log level of the server to get additional information. (See the Netscape Directory Server Administrator's Guide for information on setting the log level of the server.)

LDAP_OTHER

This result code indicates than an unknown error has occurred.

At this point in time, neither the LDAP API library nor the Netscape Directory Server return this result code.

LDAP_PARAM_ERROR

This result code indicates that an invalid parameter was specified.

The LDAP API library sets this result code if a function was called and invalid parameters were specified (for example, if the LDAP structure is NULL).

LDAP_PARTIAL_RESULTS

The Netscape Directory Server sends this result code to LDAP v2 clients to refer them to another LDAP server. When sending this code to a client, the server includes a newline-delimited list of LDAP URLs that identify another LDAP server.

If the client identifies itself as an LDAP v3 client in the request, the Netscape Directory Server sends an LDAP_REFERRAL result code instead of this result code.

LDAP_PROTOCOL_ERROR

This result code indicates that the LDAP client's request does not comply with the LDAP protocol.

The Netscape Directory Server sends this result code back to the client in the following situations:

The server cannot parse the incoming request.

The request specifies an attribute type that uses a syntax not supported by the server.

The request is a SASL bind request, but your client identifies itself as an LDAP v2 client.

Make sure to specify that your LDAP client is an LDAP v3 client. For instructions, see

"Specifying the LDAP Version of Your Client."

The request is a bind request that specifies an unsupported version of the LDAP protocol.

Make sure to specify that your LDAP client is either an LDAP v2 client or an LDAP v3 client. For instructions, see

"Specifying the LDAP Version of Your Client."

The request is an add or a modify request that specifies the addition of an attribute type to an entry, but no values are specified.

The request is a modify request, and one of the following is true:

An unknown modify operation is specified (an operation other than LDAP_MOD_ADD, LDAP_MOD_DELETE, and LDAP_MOD_REPLACE).

No modifications are specified.

The request is a modify DN request, and one of the following is true:

The new RDN is not a valid RDN.

A new superior DN is specified, but your client identifies itself as an LDAP v2 client.

Note that the Netscape Directory Server 3.x and 4.0 do not support the ability to move an entry from under one DN to another DN. If you specify a new superior DN, the request will not be processed.

The request is a search request, and one of the following is true:

An unknown scope is specified (a scope other than LDAP_SCOPE_BASE, LDAP_SCOPE_ONELEVEL, and LDAP_SCOPE_SUBTREE).

An unknown filter type is specified.

The filter type LDAP_FILTER_GE or LDAP_FILTER_LE is specified, but the type of attribute contains values that cannot be ordered. (For example, if the attribute type uses a binary syntax, the values of the attribute contain binary data, which cannot be sorted.)

The request contains an extensible filter (a filter using matching rules), but your client identifies itself as an LDAP v2 client. (Make sure to specify that your LDAP client is an LDAP v3 client. For instructions, see "Specifying the LDAP Version of Your Client.")

The request contains an extensible filter (a filter using matching rules), but the matching rule is not supported by the server.

The request is a search request with a server-side sorting control, and one of the following is true:

The server does not have a syntax plug-in that supports the attribute used for sorting.

The syntax plug-in does not have a function for comparing values of the attribute. (This compare function is used for sorting.)

The type of attribute specified for sorting contains values that cannot be sorted in any order. (For example, if the attribute type uses a binary syntax, the values of the attribute contain binary data, which cannot be sorted.)

The server encounters an error when creating the sorting response control (the control to be sent back to the client).

When sorting the results, the time limit or the "look through limit" is exceeded. (The "look through limit" is the maximum number of entries that the server will check when gathering a list of potential search result candidates. See the Netscape Directory Server Administrator's Guide for details.)

The request is an extended operation request, and the server does not support that extended operation.

In the Netscape Directory Server, extended operations are supported through extended operation server plug-ins. Make sure that the server is loading a plug-in that supports the extended operation. Check the OID of the extended operation in your LDAP client to make sure that it matches the OID of the extended operation registered in the server plug-in.

For more information on extended operation server plug-ins, see the

Netscape Directory Server Plug-In Programmer's Guide

An authentication method other than LDAP_AUTH_SIMPLE or LDAP_AUTH_SASL is specified.

LDAP_REFERRAL

This result code indicates that the server is referring the client to another LDAP server. When sending this code to a client, the server includes a list of LDAP URLs that identify another LDAP server.

This result code is part of the LDAP v3 protocol. For LDAP v2 clients, the Netscape Directory Server sends an LDAP_PARTIAL_RESULTS result code instead.

LDAP_REFERRAL_LIMIT_EXCEEDED

This result code indicates that the "referral hop limit" was exceeded.

The LDAP API library sets this result code when following referrals, if the client is referred to other servers more times than allowed by the "referral hop limit". For more information about the "referral hop limit", see "Limiting Referral Hops."

LDAP_RESULTS_TOO_LARGE

This result code indicates that the results of the request are too large.

Currently, the Netscape Directory Server does not send this result code back to LDAP clients.

LDAP_SASL_BIND_IN_PROGRESS

This result code is used in multi-stage SASL bind operations. The server sends this result code back to the client to indicate that the authentication process has not yet completed.

For more information on SASL authentication, see Chapter 13, "Using SASL Authentication".

LDAP_SERVER_DOWN

This result code indicates that the LDAP API library cannot establish a connection (or lost the connection) with the LDAP server.

If you have lost the connection to the server, see "Handling Failover" for instructions on reconnecting to the server.

LDAP_SIZELIMIT_EXCEEDED

This result code indicates that the maximum number of search results to return has been exceeded.

The size limit is specified in the search request. If you specify no size limit, the server will set the time limit.

When working with the Netscape Directory Server, keep in mind the following:

If you are bound as the root DN and specify no size limit, the server enforces no size limit at all.

If you are not bound as the root DN and specify no size limit, the server sets the size limit to the value specified by the sizelimit directive in the server's slapd.conf configuration file.

If the size limit that you specify exceeds the value specified by the sizelimit directive in the server's slapd.conf configuration file, the server uses the size limit specified in the configuration file.

LDAP_SORT_CONTROL_MISSING

This result code indicates that server did not receive a required server-side sorting control.

The Netscape Directory Server 4.0 sends this result code back to the client if the server receives a search request with a "virtual list view" control but no server-side sorting control.

The "virtual list view" control requires a server-side sorting control. For more information on this control, see "Using the Virtual List View Control."

Note that versions of the Netscape Directory Server prior to 4.0 do not support the "virtual list view" control.

LDAP_STRONG_AUTH_NOT_SUPPORTED

This result code is returned as the result of a bind operation. This code indicates that the server does not recognize or support the specified authentication method.

LDAP_STRONG_AUTH_REQUIRED

This result code indicates that a stronger method of authentication is required to perform the operation.

Currently, the Netscape Directory Server does not send this result code back to LDAP clients.

LDAP_SUCCESS

This result code indicates that the LDAP operation was successful.

LDAP_TIMELIMIT_EXCEEDED

This result code indicates that the time limit on a search operation has been exceeded.

The time limit is specified in the search request. If you specify no time limit, the server will set the time limit.

When working with the Netscape Directory Server, keep in mind the following:

If you are bound as the root DN and specify no time limit, the server enforces no size limit at all.

If you are not bound as the root DN and specify no time limit, the server sets the time limit to the value specified by the timelimit directive in the server's slapd.conf configuration file.

If the time limit that you specify exceeds the value specified by the timelimit directive in the server's slapd.conf configuration file, the server uses the time limit specified in the configuration file.

LDAP_TIMEOUT

This result code indicates that the LDAP client timed out while waiting for a response from the server.

The LDAP API library sets this result code in the LDAP structure if the timeout period (for example, in a search request) has been exceeded and the server has not responded.