When a client makes an LDAP search against a directory like AD or OpenLDAP, are the results that come back required to represent the state of the directory either before or after any modifying operations have been performed?

Or put another way, if I perform a big search, and in the meantime, several modifying operations are performed that affect some of the results, is it possible that my search results may contain some results that were from before the modifying operations and some results that were from after the modifying operations?


1 Answer 1


There aren't any guarantees for results or locking semantics or a transaction isolation level for reads. There is also the case of distributed databases to consider. Even if the LDAP server you are querying only has one process querying and performing updates, and update could be replicated inbound during your query.

If you're wondering how to handle this, you could check a value such as usnChanged before performing an update, and prompt a user to refresh the object before committing changes. You may also want to check if the object still exists. (usnChanged will exist even if isDeleted is true). And don't use distinguished name as a unique value to identify an object (objectGuid in Active Directory would be the reference identifier).

With Active Directory, it is also possible to register for change notifications.

Change Notifications in Active Directory Domain Services

Polling for Changes Using the DirSync Control

Active Directory - Overview of Change Tracking Techniques

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .