PermissiveModifyControl throws a DirectoryOperationException in C # LDAP

Question

Using the System.DirectoryServices.Protocols namespace to add / change attributes in an Active Directory group. The code:

 public void UpdateProperties(Dictionary<string, string> Properties) { List<DirectoryAttributeModification> directoryAttributeModifications; // ... Code to convert Properties dictionary to directoryAttributeModifications // There is one 'Add' modification, to set the 'description' of the group ModifyRequest modifyRequest = new ModifyRequest(groupDistinguishedName, directoryAttributeModifications.ToArray()); modifyRequest.Controls.Add(new PermissiveModifyControl()); ModifyResponse response = connection.SendRequest(modifyRequest) as ModifyResponse; 

PermissiveModifyControl designed to prevent code failure if a description already exists. The only PermissiveModifyControl information I found is here: http://msdn.microsoft.com/en-us/library/bb332056.aspx

which reads:

An LDAP change request is usually aborted if it tries to add an existing attribute or tries to remove an attribute that does not exist. Using PermissiveModifyControl change operation succeeds without causing a DirectoryOperationException error.

However, when the above code falls into SendRequest() , it throws a DirectoryOperationException : "An attribute exists or a value has been assigned."

What I'm trying to avoid is to request each property in the transferred collection; if it exists, create a Replace DirectoryAttributeModification ; if not, create Add instead. From what I can learn, PermissiveModifyControl should do just that.

Can anyone shed some light on why PermissiveModifyControl is still throwing a DirectoryOperationException and how to use it correctly?

Thanks in advance! James

Answer 1

After several experiments, I found that the documentation is misleading ... you do not want to add an attribute, you want to replace it ( DirectoryAttributeOperation.Replace ). If an attribute exists, it will of course replace it. If the attribute does not exist, it will create it.

The rest of my code is correct.