Issue #1258 - Part 1: Import mailnews, ldap, and mork from comm-esr52.9.1

14 files changed, 1747 insertions, 0 deletions

diff --git a/ldap/xpcom/public/moz.build b/ldap/xpcom/public/moz.build
new file mode 100644
index 000000000..9ff6b21c6
--- /dev/null
+++ b/ldap/xpcom/public/moz.build
@@ -0,0 +1,27 @@
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+XPIDL_SOURCES += [
+    'nsILDAPBERElement.idl',
+    'nsILDAPBERValue.idl',
+    'nsILDAPConnection.idl',
+    'nsILDAPControl.idl',
+    'nsILDAPErrors.idl',
+    'nsILDAPMessage.idl',
+    'nsILDAPMessageListener.idl',
+    'nsILDAPModification.idl',
+    'nsILDAPOperation.idl',
+    'nsILDAPServer.idl',
+    'nsILDAPService.idl',
+    'nsILDAPURL.idl',
+]
+
+if CONFIG['MOZ_PREF_EXTENSIONS']:
+    XPIDL_SOURCES += [
+        'nsILDAPSyncQuery.idl',
+    ]
+
+XPIDL_MODULE = 'mozldap'
+
diff --git a/ldap/xpcom/public/nsILDAPBERElement.idl b/ldap/xpcom/public/nsILDAPBERElement.idl
new file mode 100644
index 000000000..24a662782
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPBERElement.idl
@@ -0,0 +1,122 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * 
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsILDAPBERValue;
+
+
+/**
+ * nsILDAPBERElement is a wrapper interface for a C-SDK BerElement object.
+ * Typically, this is used as an intermediate object to aid in the manual 
+ * construction of a BER value.  Once the construction is completed by calling
+ * methods on this object, an nsILDAPBERValue can be retrieved from the 
+ * asValue attribute on this interface.
+ *
+ * <http://www.mozilla.org/directory/ietf-docs/draft-ietf-ldapext-ldap-c-api-05.txt>
+ * contains some documentation that mostly (but not exactly) matches
+ * the code that this wraps in section 17.
+ */
+
+[scriptable, uuid(409f5b31-c062-4d11-a35b-0a09e7967bf2)]
+interface nsILDAPBERElement : nsISupports 
+{
+  /**
+   * Initialize this object.  Must be called before calling any other method
+   * on this interface.
+   *
+   * @param  aValue  value to preinitialize with; 0 for a new empty object
+   *
+   * @exception  NS_ERROR_NOT_IMPLEMENTED  preinitialization is currently
+   *                                       not implemented
+   * @exception  NS_ERROR_OUT_OF_MEMORY    unable to allocate the internal
+   *                                       BerElement
+   */
+  void init(in nsILDAPBERValue aValue);
+
+  /**
+   * Most TAG_* constants can be used in the construction or passing in of 
+   * values to the aTag arguments to most of the methods in this interface.
+   */
+
+  /** 
+   * When returned from a parsing method, 0xffffffff is referred to 
+   * has the parse-error semantic (ie TAG_LBER_ERROR); when passing it to
+   * a construction method, it is used to mean "pick the default tag for 
+   * this type" (ie TAG_LBER_DEFAULT).
+   */
+  const unsigned long TAG_LBER_ERROR = 0xffffffff;
+  const unsigned long TAG_LBER_DEFAULT = 0xffffffff;
+  const unsigned long TAG_LBER_END_OF_SEQORSET = 0xfffffffe;
+
+  /** 
+   * BER encoding types and masks
+   */
+  const unsigned long TAG_LBER_PRIMITIVE = 0x00;
+
+  /**
+   * The following two tags are carried over from the LDAP C SDK; their
+   * exact purpose there is not well documented.  They both have
+   * the same value there as well.
+   */
+  const unsigned long TAG_LBER_CONSTRUCTED = 0x20;
+  const unsigned long TAG_LBER_ENCODING_MASK = 0x20;
+
+  const unsigned long TAG_LBER_BIG_TAG_MASK = 0x1f;
+  const unsigned long TAG_LBER_MORE_TAG_MASK = 0x80;
+
+  /**
+   * general BER types we know about
+   */
+  const unsigned long TAG_LBER_BOOLEAN = 0x01;
+  const unsigned long TAG_LBER_INTEGER = 0x02;
+  const unsigned long TAG_LBER_BITSTRING = 0x03;
+  const unsigned long TAG_LBER_OCTETSTRING = 0x04;
+  const unsigned long TAG_LBER_NULL =	0x05;
+  const unsigned long TAG_LBER_ENUMERATED = 0x0a;
+  const unsigned long TAG_LBER_SEQUENCE	= 0x30;
+  const unsigned long TAG_LBER_SET = 0x31;
+
+  /**
+   * Write a string to this element.  
+   *
+   * @param  aString  string to write
+   * @param  aTag     tag for this string (if TAG_LBER_DEFAULT is used,
+   *                  TAG_LBER_OCTETSTRING will be written).
+   *
+   * @return     number of bytes written
+   *
+   * @exception  NS_ERROR_FAILUE   C-SDK returned error
+   */
+  unsigned long putString(in AUTF8String aString, in unsigned long aTag);
+
+  /**
+   * Start a set.  Sets may be nested.
+   *
+   * @param  aTag  tag for this set (if TAG_LBER_DEFAULT is used, 
+   *               TAG_LBER_SET will be written).
+   *
+   * @exception  NS_ERROR_FAILUE   C-SDK returned an error
+   */
+  void startSet(in unsigned long aTag);
+
+  /**
+   * Cause the entire set started by the last startSet() call to be written.
+   *
+   * @exception  NS_ERROR_FAILUE   C-SDK returned an error
+   *
+   * @return     number of bytes written
+   */
+  unsigned long putSet();
+
+  /**
+   * an nsILDAPBERValue version of this element.  Calls ber_flatten() under
+   * the hood.
+   *
+   * @exception NS_ERROR_OUT_OF_MEMORY
+   */
+  readonly attribute nsILDAPBERValue asValue;
+};
diff --git a/ldap/xpcom/public/nsILDAPBERValue.idl b/ldap/xpcom/public/nsILDAPBERValue.idl
new file mode 100644
index 000000000..da918d639
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPBERValue.idl
@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * 
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+/**
+ * Representation of a BER value as an interface containing an array of
+ * bytes.  Someday this should perhaps be obsoleted by a better, more
+ * generalized version of nsIByteBuffer, but that's currently not even
+ * scriptable (see bug 125596).  
+ */
+[scriptable, uuid(c817c5fe-1dd1-11b2-a10b-ae9885762ea9)]
+interface nsILDAPBERValue : nsISupports 
+{
+    /**
+     * Set the BER value from an array of bytes (copies).
+     *
+     * @exception NS_ERROR_OUT_OF_MEMORY    couldn't allocate buffer to copy to
+     */
+    void set(in unsigned long aCount, 
+             [array, size_is(aCount)] in octet aValue);
+
+    /** 
+     * Set the BER value from a UTF8 string (copies).
+     *
+     * @exception NS_ERROR_OUT_OF_MEMORY    couldn't allocate buffer to copy to
+     */
+    void setFromUTF8(in AUTF8String aValue);
+
+    /** 
+     * Get the BER value as an array of bytes.  Note that if this value is
+     * zero-length, aCount and aRetVal will both be 0.  This means that 
+     * (in C++ anyway) the caller MUST test either aCount or aRetval before
+     * dereferencing aRetVal.
+     *
+     * @exception NS_ERROR_OUT_OF_MEMORY    couldn't allocate buffer to copy to
+     */
+    void get(out unsigned long aCount, 
+             [retval, array, size_is(aCount)] out octet aRetVal);
+};
+
diff --git a/ldap/xpcom/public/nsILDAPConnection.idl b/ldap/xpcom/public/nsILDAPConnection.idl
new file mode 100644
index 000000000..63b367363
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPConnection.idl
@@ -0,0 +1,77 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsILDAPOperation;
+interface nsILDAPMessageListener;
+interface nsILDAPURL;
+
+%{C++
+#define NS_LDAPCONNECTION_CONTRACTID "@mozilla.org/network/ldap-connection;1" 
+%}
+
+[scriptable, uuid(360c1ff7-15e3-4ffe-b4b8-0eda72ebc096)]
+interface nsILDAPConnection : nsISupports
+{
+    /**
+     * the string version of lderrno
+     */
+    readonly attribute wstring errorString;
+
+    /**
+     * DN to bind as.  use the init() method to set this.
+     *
+     * @exception NS_ERROR_OUT_OF_MEMORY
+     */
+    readonly attribute AUTF8String bindName;
+    
+    /**
+     * private parameter (anything caller desires)
+     */
+    attribute nsISupports closure;
+
+    /** 
+     * Set up the connection.  Note that init() must be called on a thread
+     * that already has an nsIEventQueue.
+     *
+     * @param aUrl              A URL for the ldap server. The host, port and
+     *                          ssl connection type will be extracted from this
+     * @param aBindName         DN to bind as
+     * @param aMessageListener  Callback for DNS resolution completion
+     * @param aClosure          private parameter (anything caller desires)
+     * @param aVersion          LDAP version to use (currently VERSION2 or 
+     *                          VERSION3)
+     *
+     * @exception NS_ERROR_ILLEGAL_VALUE        null pointer or invalid version
+     * @exception NS_ERROR_OUT_OF_MEMORY        ran out of memory
+     * @exception NS_ERROR_OFFLINE              we are in off-line mode
+     * @exception NS_ERROR_FAILURE              
+     * @exception NS_ERROR_UNEXPECTED           internal error
+     */
+    void init(in nsILDAPURL aUrl,
+              in AUTF8String aBindName,
+              in nsILDAPMessageListener aMessageListener,
+              in nsISupports aClosure, in unsigned long aVersion);
+
+    const unsigned long VERSION2 = 2;
+    const unsigned long VERSION3 = 3;
+
+    /**
+     * Get information about the last error that occured on this connection.
+     *
+     * @param matched   if the server is returning LDAP_NO_SUCH_OBJECT, 
+     *                  LDAP_ALIAS_PROBLEM, LDAP_INVALID_DN_SYNTAX, 
+     *                  or LDAP_ALIAS_DEREF_PROBLEM, this will contain
+     *                  the portion of DN that matches the entry that is 
+     *                  closest to the requested entry
+     *
+     * @param s         additional error information from the server
+     * 
+     * @return          the error code, as defined in nsILDAPErrors.idl
+     */
+    long getLdErrno(out AUTF8String matched, out AUTF8String s);
+};
diff --git a/ldap/xpcom/public/nsILDAPControl.idl b/ldap/xpcom/public/nsILDAPControl.idl
new file mode 100644
index 000000000..89b87f850
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPControl.idl
@@ -0,0 +1,45 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * 
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsILDAPBERValue;
+
+/**
+ * XPCOM representation of the C SDK LDAPControl structure.
+ */
+[scriptable, uuid(3a7ceb8e-482a-4a4f-9aa4-26b9a69a3595)]
+interface nsILDAPControl : nsISupports
+{
+  /**
+   * Control type, represented as a string.
+   *
+   * @exceptions   none
+   */
+  attribute ACString oid;
+
+  /**
+   * The data associated with a control, if any.  To specify that no data 
+   * is to be associated with the control, don't set this at all (which
+   * is equivalent to setting it to null).  
+   *
+   * @note Specifying a zero-length value is not currently supported.  At some
+   * date, setting this to an nsILDAPBERValue which has not had any of the
+   * set methods called will be the appropriate way to do that.
+   *
+   * @exceptions   none
+   */
+  attribute nsILDAPBERValue value;
+
+  /**
+   * Should the client or server abort if the control is not understood?
+   * Should be set to false for server controls used in abandon and unbind
+   * operations, since those have no server response.
+   *
+   * @exceptions   none
+   */
+  attribute boolean isCritical;
+};
diff --git a/ldap/xpcom/public/nsILDAPErrors.idl b/ldap/xpcom/public/nsILDAPErrors.idl
new file mode 100644
index 000000000..f85f75d79
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPErrors.idl
@@ -0,0 +1,447 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+/**
+ * Error codes used in the LDAP XPCOM SDK.
+ *
+ * Taken from the Mozilla C SDK's ldap.h include file, these should be
+ * the same as those specified in the draft-ietf-ldapext-ldap-c-api-04.txt 
+ * Internet Draft.  
+ *
+ * The only good documentation I'm aware of for these error codes is
+ * at <http://docs.iplanet.com/docs/manuals/directory.html#SDKC>.
+ * Unfortunately, this does not currently seem to be available under any
+ * open source license, so I can't include that documentation here as
+ * doxygen comments.
+ *
+ */
+[scriptable, uuid(f9ac10fa-1dd1-11b2-9798-8d5cbda95d74)]
+interface nsILDAPErrors : nsISupports
+{
+
+    const long SUCCESS = 0x00;
+
+    const long OPERATIONS_ERROR = 0x01;
+
+    const long PROTOCOL_ERROR = 0x02;
+
+    const long TIMELIMIT_EXCEEDED = 0x03;
+
+    const long SIZELIMIT_EXCEEDED = 0x04;
+
+    const long COMPARE_FALSE = 0x05;
+
+    const long COMPARE_TRUE = 0x06;
+
+    const long STRONG_AUTH_NOT_SUPPORTED = 0x07;
+
+    const long STRONG_AUTH_REQUIRED = 0x08;
+
+
+    /**
+     * UMich LDAPv2 extension
+     */
+    const long PARTIAL_RESULTS = 0x09;
+
+    /**
+     * new in LDAPv3
+     */
+    const long REFERRAL = 0x0a;
+
+    /**
+     * new in LDAPv3
+     */
+    const long ADMINLIMIT_EXCEEDED = 0x0b;
+
+    /**
+     * new in LDAPv3
+     */
+    const long UNAVAILABLE_CRITICAL_EXTENSION = 0x0c;
+
+    /**
+     * new in LDAPv3
+     */
+    const long CONFIDENTIALITY_REQUIRED = 0x0d;
+
+    /**
+     * new in LDAPv3
+     */
+    const long SASL_BIND_IN_PROGRESS = 0x0e;
+
+    const long NO_SUCH_ATTRIBUTE = 0x10;
+
+    const long UNDEFINED_TYPE = 0x11;
+
+    const long INAPPROPRIATE_MATCHING = 0x12;
+
+    const long CONSTRAINT_VIOLATION = 0x13;
+
+    const long TYPE_OR_VALUE_EXISTS = 0x14;
+
+    const long INVALID_SYNTAX = 0x15;
+
+    const long NO_SUCH_OBJECT = 0x20;
+
+    const long ALIAS_PROBLEM = 0x21;
+
+    const long INVALID_DN_SYNTAX = 0x22;
+
+    /**
+     * not used in LDAPv3
+     */
+    const long IS_LEAF = 0x23;
+
+    const long ALIAS_DEREF_PROBLEM = 0x24;
+
+    const long INAPPROPRIATE_AUTH = 0x30;
+
+    const long INVALID_CREDENTIALS = 0x31;
+ 
+    const long INSUFFICIENT_ACCESS = 0x32;
+
+    const long BUSY = 0x33;
+
+    const long UNAVAILABLE = 0x34;    
+
+    const long UNWILLING_TO_PERFORM = 0x35;
+
+    const long LOOP_DETECT = 0x36;
+
+    /**
+     * server side sort extension
+     */
+    const long SORT_CONTROL_MISSING = 0x3C;
+
+    /**
+     * VLV extension
+     */
+    const long INDEX_RANGE_ERROR = 0x3D;
+
+    const long NAMING_VIOLATION = 0x40;
+
+    const long OBJECT_CLASS_VIOLATION = 0x41;
+
+    const long NOT_ALLOWED_ON_NONLEAF = 0x42;
+
+    const long NOT_ALLOWED_ON_RDN = 0x43;
+
+    const long ALREADY_EXISTS = 0x44;
+
+    const long NO_OBJECT_CLASS_MODS = 0x45;
+
+    /**
+     * reserved CLDAP
+     */
+    const long RESULTS_TOO_LARGE = 0x46;
+
+    /**
+     * new in LDAPv3
+     */
+    const long AFFECTS_MULTIPLE_DSAS = 0x47;
+
+    const long OTHER = 0x50;
+
+    const long SERVER_DOWN = 0x51;
+
+    const long LOCAL_ERROR = 0x52;
+
+    const long ENCODING_ERROR = 0x53;
+
+    const long DECODING_ERROR = 0x54;
+
+    const long TIMEOUT = 0x55;
+
+    const long AUTH_UNKNOWN = 0x56;
+
+    const long FILTER_ERROR = 0x57;
+
+    const long USER_CANCELLED = 0x58;
+
+    const long PARAM_ERROR = 0x59;
+
+    const long NO_MEMORY = 0x5a;
+
+    const long CONNECT_ERROR = 0x5b;
+
+    /**
+     * new in LDAPv3
+     */
+    const long NOT_SUPPORTED = 0x5c;
+
+    /**
+     * new in LDAPv3
+     */
+    const long CONTROL_NOT_FOUND = 0x5d;
+
+    /**
+     * new in LDAPv3
+     */
+    const long NO_RESULTS_RETURNED = 0x5e;
+
+    /**
+     * new in LDAPv3
+     */
+    const long MORE_RESULTS_TO_RETURN = 0x5f;
+
+    /**
+     * new in LDAPv3
+     */
+    const long CLIENT_LOOP = 0x60;
+
+    /**
+     * new in LDAPv3
+     */
+    const long REFERRAL_LIMIT_EXCEEDED = 0x61;
+};
+
+/* 
+ * Map these errors codes into the nsresult namespace in C++
+ */
+%{C++
+
+#define NS_ERROR_LDAP_OPERATIONS_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::OPERATIONS_ERROR)
+
+#define NS_ERROR_LDAP_PROTOCOL_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::PROTOCOL_ERROR)
+
+#define NS_ERROR_LDAP_TIMELIMIT_EXCEEDED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::TIMELIMIT_EXCEEDED)
+
+#define NS_ERROR_LDAP_SIZELIMIT_EXCEEDED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::SIZELIMIT_EXCEEDED)
+
+#define NS_ERROR_LDAP_COMPARE_FALSE \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::COMPARE_FALSE)
+
+#define NS_ERROR_LDAP_COMPARE_TRUE \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::COMPARE_TRUE)
+
+#define NS_ERROR_LDAP_STRONG_AUTH_NOT_SUPPORTED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::STRONG_AUTH_NOT_SUPPORTED)
+
+#define NS_ERROR_LDAP_STRONG_AUTH_REQUIRED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::STRONG_AUTH_REQUIRED)
+
+#define NS_ERROR_LDAP_PARTIAL_RESULTS \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::PARTIAL_RESULTS)
+
+#define NS_ERROR_LDAP_REFERRAL \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::REFERRAL)
+
+#define NS_ERROR_LDAP_ADMINLIMIT_EXCEEDED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::ADMINLIMIT_EXCEEDED)
+
+#define NS_ERROR_LDAP_UNAVAILABLE_CRITICAL_EXTENSION \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::UNAVAILABLE_CRITICAL_EXTENSION)
+
+#define NS_ERROR_LDAP_CONFIDENTIALITY_REQUIRED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::CONFIDENTIALITY_REQUIRED)
+
+#define NS_ERROR_LDAP_SASL_BIND_IN_PROGRESS \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::SASL_BIND_IN_PROGRESS)
+
+#define NS_ERROR_LDAP_NO_SUCH_ATTRIBUTE \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NO_SUCH_ATTRIBUTE)
+
+#define NS_ERROR_LDAP_UNDEFINED_TYPE \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::UNDEFINED_TYPE)
+
+#define NS_ERROR_LDAP_INAPPROPRIATE_MATCHING \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::INAPPROPRIATE_MATCHING)
+
+#define NS_ERROR_LDAP_CONSTRAINT_VIOLATION \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::CONSTRAINT_VIOLATION)
+
+#define NS_ERROR_LDAP_TYPE_OR_VALUE_EXISTS \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::TYPE_OR_VALUE_EXISTS)
+
+#define NS_ERROR_LDAP_INVALID_SYNTAX \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::INVALID_SYNTAX)
+
+#define NS_ERROR_LDAP_NO_SUCH_OBJECT \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NO_SUCH_OBJECT)
+
+#define NS_ERROR_LDAP_ALIAS_PROBLEM \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::ALIAS_PROBLEM)
+
+#define NS_ERROR_LDAP_INVALID_DN_SYNTAX \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::INVALID_DN_SYNTAX)
+
+#define NS_ERROR_LDAP_IS_LEAF \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::IS_LEAF)
+
+#define NS_ERROR_LDAP_ALIAS_DEREF_PROBLEM \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::ALIAS_DEREF_PROBLEM)
+
+#define NS_ERROR_LDAP_INAPPROPRIATE_AUTH \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::INAPPROPRIATE_AUTH)
+
+#define NS_ERROR_LDAP_INVALID_CREDENTIALS \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::INVALID_CREDENTIALS)
+
+#define NS_ERROR_LDAP_INSUFFICIENT_ACCESS \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::INSUFFICIENT_ACCESS)
+
+#define NS_ERROR_LDAP_BUSY \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::BUSY)
+
+#define NS_ERROR_LDAP_UNAVAILABLE \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::UNAVAILABLE)
+
+#define NS_ERROR_LDAP_UNWILLING_TO_PERFORM \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::UNWILLING_TO_PERFORM)
+
+#define NS_ERROR_LDAP_LOOP_DETECT \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::LOOP_DETECT)
+
+#define NS_ERROR_LDAP_SORT_CONTROL_MISSING \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::SORT_CONTROL_MISSING)
+
+#define NS_ERROR_LDAP_INDEX_RANGE_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::INDEX_RANGE_ERROR)
+
+#define NS_ERROR_LDAP_NAMING_VIOLATION \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NAMING_VIOLATION)
+
+#define NS_ERROR_LDAP_OBJECT_CLASS_VIOLATION \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::OBJECT_CLASS_VIOLATION)
+
+#define NS_ERROR_LDAP_NOT_ALLOWED_ON_NONLEAF \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NOT_ALLOWED_ON_NONLEAF)
+
+#define NS_ERROR_LDAP_NOT_ALLOWED_ON_RDN \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NOT_ALLOWED_ON_RDN)
+
+#define NS_ERROR_LDAP_ALREADY_EXISTS \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::ALREADY_EXISTS)
+
+#define NS_ERROR_LDAP_NO_OBJECT_CLASS_MODS \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NO_OBJECT_CLASS_MODS)
+
+#define NS_ERROR_LDAP_RESULTS_TOO_LARGE \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::RESULTS_TOO_LARGE)
+
+#define NS_ERROR_LDAP_AFFECTS_MULTIPLE_DSAS \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::AFFECTS_MULTIPLE_DSAS)
+
+#define NS_ERROR_LDAP_OTHER \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::OTHER)
+
+#define NS_ERROR_LDAP_SERVER_DOWN \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::SERVER_DOWN)
+
+#define NS_ERROR_LDAP_LOCAL_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::LOCAL_ERROR)
+
+#define NS_ERROR_LDAP_ENCODING_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::ENCODING_ERROR)
+
+#define NS_ERROR_LDAP_DECODING_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::DECODING_ERROR)
+
+#define NS_ERROR_LDAP_TIMEOUT \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::TIMEOUT)
+
+#define NS_ERROR_LDAP_AUTH_UNKNOWN \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::AUTH_UNKNOWN)
+
+#define NS_ERROR_LDAP_FILTER_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::FILTER_ERROR)
+
+#define NS_ERROR_LDAP_USER_CANCELLED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::USER_CANCELLED)
+
+#define NS_ERROR_LDAP_PARAM_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::PARAM_ERROR)
+
+#define NS_ERROR_LDAP_NO_MEMORY \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NO_MEMORY)
+
+#define NS_ERROR_LDAP_CONNECT_ERROR \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::CONNECT_ERROR)
+
+#define NS_ERROR_LDAP_NOT_SUPPORTED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NOT_SUPPORTED)
+
+#define NS_ERROR_LDAP_CONTROL_NOT_FOUND \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::CONTROL_NOT_FOUND)
+
+#define NS_ERROR_LDAP_NO_RESULTS_RETURNED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::NO_RESULTS_RETURNED)
+
+#define NS_ERROR_LDAP_MORE_RESULTS_TO_RETURN \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::MORE_RESULTS_TO_RETURN)
+
+#define NS_ERROR_LDAP_CLIENT_LOOP \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::CLIENT_LOOP)
+
+#define NS_ERROR_LDAP_REFERRAL_LIMIT_EXCEEDED \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_LDAP, \
+                              nsILDAPErrors::REFERRAL_LIMIT_EXCEEDED)
+
+%}
diff --git a/ldap/xpcom/public/nsILDAPMessage.idl b/ldap/xpcom/public/nsILDAPMessage.idl
new file mode 100644
index 000000000..7b3298e48
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPMessage.idl
@@ -0,0 +1,170 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * 
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsILDAPBERValue;
+interface nsILDAPOperation;
+
+%{C++
+#define NS_LDAPMESSAGE_CONTRACTID "@mozilla.org/network/ldap-message;1"
+%}
+
+[scriptable, uuid(973ff50f-2002-4f0c-b57d-2242156139a2)]
+interface nsILDAPMessage : nsISupports
+{
+    /**
+     * The Distinguished Name of the entry associated with this message.
+     * 
+     * @exception NS_ERROR_OUT_OF_MEMORY        ran out of memory
+     * @exception NS_ERROR_ILLEGAL_VALUE        null pointer passed in
+     * @exception NS_ERROR_LDAP_DECODING_ERROR  problem during BER-decoding
+     * @exception NS_ERROR_UNEXPECTED           bug or memory corruption
+     */
+    readonly attribute AUTF8String dn;
+
+    /**
+     * Get all the attributes in this message.
+     *
+     * @exception NS_ERROR_OUT_OF_MEMORY
+     * @exception NS_ERROR_ILLEGAL_VALUE        null pointer passed in
+     * @exception NS_ERROR_UNEXPECTED           bug or memory corruption
+     * @exception NS_ERROR_LDAP_DECODING_ERROR  problem during BER decoding
+     *
+     * @return  array of all attributes in the current message
+     */
+    void getAttributes(out unsigned long count, 
+                       [retval, array, size_is(count)] out string aAttributes);
+
+    /**
+     * Get an array of all the attribute values in this message.
+     *
+     * @param attr      The attribute whose values are to be returned
+     * @param count     Number of values in the outbound array.
+     * @param values    Array of values
+     *
+     * @exception NS_ERROR_UNEXPECTED           Bug or memory corruption
+     * @exception NS_ERROR_LDAP_DECODING_ERROR  Attribute not found or other 
+     *                                          decoding error.
+     * @exception NS_ERROR_OUT_OF_MEMORY
+     */
+    void getValues(in string attr, out unsigned long count, 
+                   [retval, array, size_is(count)] out wstring values);
+
+    /**
+     * The operation this message originated from
+     * 
+     * @exception NS_ERROR_NULL_POINTER         NULL pointer to getter
+     */
+    readonly attribute nsILDAPOperation operation;
+
+    /**
+     * The result code (aka lderrno) for this message.  
+     *
+     * IDL definitions for these constants live in nsILDAPErrors.idl.
+     *
+     * @exception NS_ERROR_ILLEGAL_VALUE    null pointer passed in
+     */
+    readonly attribute long errorCode;
+
+    /**
+     * The result type of this message.  Possible types listed below, the 
+     * values chosen are taken from the draft-ietf-ldapext-ldap-c-api-04.txt
+     * and are the same ones used in the ldap.h include file from the Mozilla
+     * LDAP C SDK.
+     *
+     * @exception NS_ERROR_ILLEGAL_VALUE    null pointer passed in
+     * @exception NS_ERROR_UNEXPECTED       internal error (possible memory
+     *                                                      corruption)
+     */
+    readonly attribute long type;
+
+    /**
+     * Result of a bind operation
+     */
+    const long RES_BIND = 0x61;
+
+    /**
+     * An entry found in an search operation.
+     */
+    const long RES_SEARCH_ENTRY = 0x64;
+
+    /**
+     * An LDAPv3 search reference (a referral to another server)
+     */
+    const long RES_SEARCH_REFERENCE = 0x73;
+
+    /** 
+     * The result of a search operation (i.e. the search is done; no more
+     * entries to follow).
+     */
+    const long RES_SEARCH_RESULT = 0x65;
+
+    /**
+     * The result of a modify operation.
+     */
+    const long RES_MODIFY = 0x67;
+
+    /** 
+     * The result of an add operation
+     */
+    const long RES_ADD = 0x69;
+    
+    /**
+     * The result of a delete operation
+     */
+    const long RES_DELETE = 0x6B;
+
+    /**
+     * The result of an modify DN operation
+     */
+    const long RES_MODDN = 0x6D;
+
+    /**
+     * The result of a compare operation
+     */
+    const long RES_COMPARE = 0x6F;
+
+    /** 
+     * The result of an LDAPv3 extended operation
+     */
+    const long RES_EXTENDED = 0x78;
+
+    /**
+     * get an LDIF-like string representation of this message
+     *
+     * @return unicode encoded string representation.
+     */
+    wstring toUnicode();
+
+    /**
+     * Additional error information optionally sent by the server.
+     */
+    readonly attribute AUTF8String errorMessage;
+
+    /**
+     * In LDAPv3, when the server returns any of the following errors:
+     * NO_SUCH_OBJECT, ALIAS_PROBLEM, INVALID_DN_SYNTAX, ALIAS_DEREF_PROBLEM,
+     * it also returns the closest existing DN to the entry requested.
+     */
+    readonly attribute AUTF8String matchedDn;
+
+    /**
+     * Get an array of all the attribute values in this message (a wrapper
+     * around the LDAP C SDK's get_values_len()).
+     *
+     * @param attr      The attribute whose values are to be returned
+     * @param count     Number of values in the outbound array.
+     * @param values    Array of nsILDAPBERValue objects
+     *
+     * @exception NS_ERROR_UNEXPECTED           Bug or memory corruption
+     * @exception NS_ERROR_LDAP_DECODING_ERROR  Attribute not found or other 
+     *                                          decoding error.
+     * @exception NS_ERROR_OUT_OF_MEMORY
+     */
+    void getBinaryValues(in string attr, out unsigned long count,
+                         [retval, array, size_is(count)] out nsILDAPBERValue values);
+};
diff --git a/ldap/xpcom/public/nsILDAPMessageListener.idl b/ldap/xpcom/public/nsILDAPMessageListener.idl
new file mode 100644
index 000000000..8d4da5354
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPMessageListener.idl
@@ -0,0 +1,40 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * 
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsILDAPMessage;
+
+interface nsILDAPConnection;
+
+/** 
+ * A callback interface to be implemented by any objects that want to 
+ * receive results from an nsILDAPOperation (ie nsILDAPMessages) as they
+ * come in.
+ */
+[scriptable, uuid(dc721d4b-3ff2-4387-a80c-5e29545f774a)]
+interface nsILDAPMessageListener : nsISupports
+{
+    /**
+     * Messages received are passed back via this function.
+     *
+     * @arg aMessage  The message that was returned, NULL if none was.
+     *
+     * XXX semantics of NULL?
+     */
+    void onLDAPMessage(in nsILDAPMessage aMessage);
+
+    /**
+     * Notify the listener that the Init has completed, passing
+     * in the results from the connection initialization. The
+     * Reason for this is to allow us to do asynchronous DNS
+     * lookups, preresolving hostnames.
+     *
+     * @arg aConn     The LDAP connection in question
+     * @arg aStatus   The result from the LDAP connection init
+     */
+    void onLDAPInit(in nsILDAPConnection aConn, in nsresult aStatus);
+};
diff --git a/ldap/xpcom/public/nsILDAPModification.idl b/ldap/xpcom/public/nsILDAPModification.idl
new file mode 100644
index 000000000..6c93316e9
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPModification.idl
@@ -0,0 +1,58 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsILDAPBERValue;
+interface nsIArray;
+
+[scriptable, uuid(f64ef501-0623-11d6-a7f2-b65476fc49dc)]
+interface nsILDAPModification : nsISupports
+{
+  /**
+   * The operation to perform.
+   */
+  attribute long operation;
+
+  /**
+   * Add operation
+   */
+  const long MOD_ADD = 0x00;
+
+  /**
+   * Delete operation
+   */
+  const long MOD_DELETE = 0x01;
+
+  /**
+   * Replace operation
+   */
+  const long MOD_REPLACE = 0x02;
+
+  /**
+   * Values are BER encoded
+   */
+  const long MOD_BVALUES = 0x80;
+
+  /**
+   * The attribute to modify.
+   */
+  attribute ACString type;
+
+  /**
+   * The array of values this modification sets for the attribute
+   */
+  attribute nsIArray values;
+
+  /** 
+   * Function that allows all the attributes to be set at the same
+   * time to avoid multiple function calls.
+   */
+  void setUpModification(in long aOperation, in ACString aType,
+                         in nsIArray aValues);
+
+  void setUpModificationOneValue(in long aOperation, in ACString aType,
+                                 in nsILDAPBERValue aValue);
+};
diff --git a/ldap/xpcom/public/nsILDAPOperation.idl b/ldap/xpcom/public/nsILDAPOperation.idl
new file mode 100644
index 000000000..f3b9e6e7a
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPOperation.idl
@@ -0,0 +1,275 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * 
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+#include "nsILDAPConnection.idl"
+#include "nsIAuthModule.idl"
+
+interface nsILDAPMessage;
+interface nsILDAPMessageListener;
+interface nsILDAPModification;
+interface nsIMutableArray;
+interface nsIArray;
+
+%{C++
+#define NS_LDAPOPERATION_CONTRACTID "@mozilla.org/network/ldap-operation;1" 
+%}
+
+// XXXdmose check to make sure ctl-related err codes documented
+
+typedef uint32_t PRIntervalTime;
+
+[scriptable, uuid(4dfb1b19-fc8f-4525-92e7-f97b78a9747a)]
+interface nsILDAPOperation : nsISupports
+{
+    /**
+     * The connection this operation is on. 
+     * 
+     * @exception NS_ERROR_ILLEGAL_VALUE        a NULL pointer was passed in
+     */
+    readonly attribute nsILDAPConnection connection;
+
+    /**
+     * Callback for individual result messages related to this operation (set
+     * by the init() method).  This is actually an nsISupports proxy object, 
+     * as the callback will happen from another thread.
+     * 
+     * @exception NS_ERROR_ILLEGAL_VALUE        a NULL pointer was passed in
+     */
+    readonly attribute nsILDAPMessageListener messageListener;
+
+    /**
+     * The message-id associated with this operation.
+     *
+     * @exception NS_ERROR_ILLEGAL_VALUE        a NULL pointer was passed in
+     */
+    readonly attribute long messageID;
+
+    /**
+     * private parameter (anything caller desires)
+     */
+    attribute nsISupports closure;
+
+    /**
+     * No time and/or size limit specified
+     */
+    const long NO_LIMIT = 0;
+
+    /**
+     * If specified, these arrays of nsILDAPControls are passed into the LDAP
+     * C SDK for any extended operations (ie method calls on this interface
+     * ending in "Ext").
+     */
+    attribute nsIMutableArray serverControls;
+    attribute nsIMutableArray clientControls;
+
+    /**
+     * Initializes this operation.  Must be called prior to initiating
+     * any actual operations.  Note that by default, the aMessageListener
+     * callbacks happen on the LDAP connection thread.  If you need them
+     * to happen on the main thread (or any other thread), then you should
+     * created an nsISupports proxy object and pass that in.
+     *
+     * @param aConnection       connection this operation should use
+     * @param aMessageListener  interface used to call back the results.
+     * @param aClosure          private parameter (anything caller desires)
+     *
+     * @exception NS_ERROR_ILLEGAL_VALUE        a NULL pointer was passed in
+     * @exception NS_ERROR_UNEXPECTED           failed to get connection handle
+     */
+    void init(in nsILDAPConnection aConnection, 
+              in nsILDAPMessageListener aMessageListener,
+              in nsISupports aClosure);
+
+    /**
+     * Asynchronously authenticate to the LDAP server.
+     * 
+     * @param passwd    the password used for binding; NULL for anon-binds
+     *
+     * @exception NS_ERROR_LDAP_ENCODING_ERROR  problem encoding bind request
+     * @exception NS_ERROR_LDAP_SERVER_DOWN     server down (XXX rebinds?)
+     * @exception NS_ERROR_LDAP_CONNECT_ERROR   connection failed or lost
+     * @exception NS_ERROR_OUT_OF_MEMORY        ran out of memory
+     * @exception NS_ERROR_UNEXPECTED           internal error
+     */
+    void simpleBind(in AUTF8String passwd);
+
+    /**
+     * Asynchronously perform a SASL bind against the LDAP server
+     *
+     * @param service    the host name of the service being connected to
+     * @param mechanism  the name of the SASL mechanism in use
+     * @param authModule the nsIAuthModule to be used to perform the operation
+     *
+     */
+    void saslBind(in ACString service, in ACString mechanism, 
+                  in nsIAuthModule authModule);
+
+    /**
+     * Continue a SASL bind operation
+     *
+     * @param token     the next SASL token to send to the server
+     * @param tokenLen  the length of the token to send
+     *
+     */
+    void saslStep(in string token, in unsigned long tokenLen);
+
+    /**
+     * Kicks off an asynchronous add request.  The "ext" stands for 
+     * "extensions", and is intended to convey that this method will
+     * eventually support the extensions described in the
+     * draft-ietf-ldapext-ldap-c-api-04.txt Internet Draft.
+     *
+     * @param aBaseDn           Base DN to add
+     * @param aModCount         Number of modifications
+     * @param aMods             Array of modifications
+     *
+     * @exception NS_ERROR_NOT_INITIALIZED      operation not initialized
+     * @exception NS_ERROR_INVALID_ARG          invalid argument
+     * @exception NS_ERROR_LDAP_ENCODING_ERROR  error during BER-encoding
+     * @exception NS_ERROR_LDAP_SERVER_DOWN     the LDAP server did not
+     *                                          receive the request or the
+     *                                          connection was lost
+     * @exception NS_ERROR_OUT_OF_MEMORY        ran out of memory
+     * @exception NS_ERROR_LDAP_NOT_SUPPORTED   not supported in the version
+     *                                          of the LDAP protocol that the
+     *                                          client is using
+     * @exception NS_ERROR_UNEXPECTED           an unexpected error has
+     *                                          occurred
+     *
+     * XXX doesn't currently handle LDAPControl params
+     */
+    void addExt(in AUTF8String aBaseDn, in nsIArray aMods);
+
+    /**
+     * Kicks off an asynchronous delete request.  The "ext" stands for 
+     * "extensions", and is intended to convey that this method will
+     * eventually support the extensions described in the
+     * draft-ietf-ldapext-ldap-c-api-04.txt Internet Draft.
+     *
+     * @param aBaseDn           Base DN to delete
+     *
+     * @exception NS_ERROR_NOT_INITIALIZED      operation not initialized
+     * @exception NS_ERROR_INVALID_ARG          invalid argument
+     * @exception NS_ERROR_LDAP_ENCODING_ERROR  error during BER-encoding
+     * @exception NS_ERROR_LDAP_SERVER_DOWN     the LDAP server did not
+     *                                          receive the request or the
+     *                                          connection was lost
+     * @exception NS_ERROR_OUT_OF_MEMORY        ran out of memory
+     * @exception NS_ERROR_LDAP_NOT_SUPPORTED   not supported in the version
+     *                                          of the LDAP protocol that the
+     *                                          client is using
+     * @exception NS_ERROR_UNEXPECTED           an unexpected error has
+     *                                          occurred
+     *
+     * XXX doesn't currently handle LDAPControl params
+     */
+    void deleteExt(in AUTF8String aBaseDn);
+
+    /**
+     * Kicks off an asynchronous modify request.  The "ext" stands for 
+     * "extensions", and is intended to convey that this method will
+     * eventually support the extensions described in the
+     * draft-ietf-ldapext-ldap-c-api-04.txt Internet Draft.
+     *
+     * @param aBaseDn           Base DN to modify
+     * @param aModCount         Number of modifications
+     * @param aMods             Array of modifications
+     *
+     * @exception NS_ERROR_NOT_INITIALIZED      operation not initialized
+     * @exception NS_ERROR_INVALID_ARG          invalid argument
+     * @exception NS_ERROR_LDAP_ENCODING_ERROR  error during BER-encoding
+     * @exception NS_ERROR_LDAP_SERVER_DOWN     the LDAP server did not
+     *                                          receive the request or the
+     *                                          connection was lost
+     * @exception NS_ERROR_OUT_OF_MEMORY        ran out of memory
+     * @exception NS_ERROR_LDAP_NOT_SUPPORTED   not supported in the version
+     *                                          of the LDAP protocol that the
+     *                                          client is using
+     * @exception NS_ERROR_UNEXPECTED           an unexpected error has
+     *                                          occurred
+     *
+     * XXX doesn't currently handle LDAPControl params
+     */
+    void modifyExt(in AUTF8String aBaseDn, in nsIArray aMods);
+
+    /**
+     * Kicks off an asynchronous rename request.
+     *
+     * @param aBaseDn           Base DN to rename
+     * @param aNewRDn           New relative DN
+     * @param aNewParent        DN of the new parent under which to move the
+     *                          entry
+     * @param aDeleteOldRDn     Indicates whether to remove the old relative
+     *                          DN as a value in the entry or not
+     *
+     * @exception NS_ERROR_NOT_INITIALIZED      operation not initialized
+     * @exception NS_ERROR_INVALID_ARG          invalid argument
+     * @exception NS_ERROR_LDAP_ENCODING_ERROR  error during BER-encoding
+     * @exception NS_ERROR_LDAP_SERVER_DOWN     the LDAP server did not
+     *                                          receive the request or the
+     *                                          connection was lost
+     * @exception NS_ERROR_OUT_OF_MEMORY        ran out of memory
+     * @exception NS_ERROR_LDAP_NOT_SUPPORTED   not supported in the version
+     *                                          of the LDAP protocol that the
+     *                                          client is using
+     * @exception NS_ERROR_UNEXPECTED           an unexpected error has
+     *                                          occurred
+     *
+     * XXX doesn't currently handle LDAPControl params
+     */
+    void rename(in AUTF8String aBaseDn, in AUTF8String aNewRDn,
+                in AUTF8String aNewParent, in boolean aDeleteOldRDn);
+
+    /**
+     * Kicks off an asynchronous search request.  The "ext" stands for 
+     * "extensions", and is intended to convey that this method will
+     * eventually support the extensions described in the
+     * draft-ietf-ldapext-ldap-c-api-04.txt Internet Draft.
+     *
+     * @param aBaseDn           Base DN to search
+     * @param aScope            One of SCOPE_{BASE,ONELEVEL,SUBTREE}
+     * @param aFilter           Search filter
+     * @param aAttributes       Comma separated list of values, holding the
+     *                          attributes we need
+     * @param aTimeOut          How long to wait
+     * @param aSizeLimit        Maximum number of entries to return.
+     *
+     * @exception NS_ERROR_NOT_INITIALIZED      operation not initialized
+     * @exception NS_ERROR_LDAP_ENCODING_ERROR  error during BER-encoding
+     * @exception NS_ERROR_LDAP_SERVER_DOWN     the LDAP server did not
+     *                                          receive the request or the
+     *                                          connection was lost
+     * @exception NS_ERROR_OUT_OF_MEMORY        ran out of memory
+     * @exception NS_ERROR_INVALID_ARG          invalid argument
+     * @exception NS_ERROR_LDAP_NOT_SUPPORTED   not supported in the version
+     *                                          of the LDAP protocol that the
+     *                                          client is using
+     * @exception NS_ERROR_LDAP_FILTER_ERROR
+     * @exception NS_ERROR_UNEXPECTED
+     */
+    void searchExt(in AUTF8String aBaseDn, in int32_t aScope,
+                   in AUTF8String aFilter, in ACString aAttributes,
+                   in PRIntervalTime aTimeOut, in int32_t aSizeLimit);
+
+    /**  
+     * Cancels an async operation that is in progress.
+     *
+     * XXX controls not supported yet
+     *
+     * @exception NS_ERROR_NOT_IMPLEMENTED      server or client controls
+     *                                          were set on this object
+     * @exception NS_ERROR_NOT_INITIALIZED      operation not initialized
+     * @exception NS_ERROR_LDAP_ENCODING_ERROR  error during BER-encoding
+     * @exception NS_ERROR_LDAP_SERVER_DOWN     the LDAP server did not
+     *                                          receive the request or the
+     *                                          connection was lost
+     * @exception NS_ERROR_OUT_OF_MEMORY        out of memory
+     * @exception NS_ERROR_INVALID_ARG          invalid argument
+     * @exception NS_ERROR_UNEXPECTED           internal error
+     */
+    void abandonExt();
+};
diff --git a/ldap/xpcom/public/nsILDAPServer.idl b/ldap/xpcom/public/nsILDAPServer.idl
new file mode 100644
index 000000000..5fc9522e4
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPServer.idl
@@ -0,0 +1,86 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+#include "nsILDAPConnection.idl"
+
+interface nsILDAPURL;
+
+/**
+ * this interface provides a way to store, retrieve and manipulate
+ * information related to a specific LDAP server. This includes the
+ * LDAP URL, as well as certain user specific data (e.g. credentials).
+ *
+ * The implementation of nsILDAPService relies heavily on this
+ * interface, managing all LDAP connections (nsILDAPConnection).
+ * The Service manages LDAP connections (connect and disconnect etc.),
+ * using the information available from these LDAP Server objects.
+ */
+
+
+[scriptable, uuid(8aa717a4-1dd2-11b2-99c7-f01e2d449ded)]
+interface nsILDAPServer : nsISupports {
+
+    /**
+     * unique identifier for this server, used (typically) to identify a
+     * particular server object in a list of servers. This key can be
+     * any "string", but in our case it will most likely be the same
+     * identifier as used in a Mozilla preferences files.
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     * @exception NS_ERROR_OUT_OF_MEMORY    ran out of memory
+     */
+    attribute wstring key;
+
+    /**
+     * the password string used to bind to this server. An empty
+     * string here implies binding as anonymous.
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     * @exception NS_ERROR_OUT_OF_MEMORY    ran out of memory
+     */
+    attribute AUTF8String password;
+
+    /**
+     * the user name to authenticate as. An empty string here would
+     * imply binding as anonymous.
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     * @exception NS_ERROR_OUT_OF_MEMORY    ran out of memory
+     */
+    attribute AUTF8String username;
+
+    /**
+     * the bind DN (Distinguished Name).
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     * @exception NS_ERROR_OUT_OF_MEMORY    ran out of memory
+     */
+    attribute AUTF8String binddn;
+
+    /** maximum number of hits we want to accept from an LDAP search
+     *  operation.
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     */
+    attribute unsigned long sizelimit;
+
+    /**
+     * the URL for this server.
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     */
+    attribute nsILDAPURL url;
+
+    /**
+     * protocol version to be used (see nsILDAPConnection.idl for constants)
+     * Defaults to 3.
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer passed to getter
+     * @exception NS_ERROR_INVALID_ARG      Invalid version passed to setter
+     */
+    attribute unsigned long protocolVersion;
+};
diff --git a/ldap/xpcom/public/nsILDAPService.idl b/ldap/xpcom/public/nsILDAPService.idl
new file mode 100644
index 000000000..e4f8e75e6
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPService.idl
@@ -0,0 +1,197 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+interface nsILDAPServer;
+interface nsILDAPConnection;
+interface nsILDAPMessageListener;
+
+/**
+ * This interface provides an LDAP connection management service.
+ * It's used to cache already established LDAP connections, as well
+ * as reaping unused connections after a certain time period. This
+ * is done completely asynchronously, using callback functions.
+ */
+
+
+[scriptable, uuid(69de6fbc-2e8c-4482-bf14-358d68b785d1)]
+interface nsILDAPService : nsISupports {
+
+    /**
+     * Add a (possibly) new LDAP server entry to the service. A
+     * server entry holds information about the host, port and
+     * other components of the LDAP URL, as well as information
+     * used for binding a connection to the LDAP server.
+     *
+     * An LDAP Server entry (nsILDAPServer) contains the URL,
+     * user credentials, and other information related to the actual
+     * server itself. It is used for connecting, binding, rebinding,
+     * setting timeouts and so forth.
+     *
+     * @param aServer          an nsILDAPServer object
+     *
+     * @exception NS_ERROR_FAILURE          the server has already been
+     *                                      added to the service
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer
+     * @exception NS_ERROR_OUT_OF_MEMORY    ran out of memory
+     */
+    void addServer(in nsILDAPServer aServer);
+
+    /**
+     * Mark an LDAP server, in the Service, as a candidate for
+     * deletion. If there are still leases ("users") of this server,
+     * the operation fails.
+     *
+     * @param aKey             unique key identifying the server entry
+     *
+     * @exception NS_ERROR_FAILURE          either the server doesn't
+     *                                      exist, or there are still
+     *                                      leases oustanding
+     */
+    void deleteServer(in wstring aKey);
+
+    /**
+     * Get the nsILDAPServer object for the specified server entry
+     * in the service.
+     *
+     * @param aKey             unique key identifying the server entry
+     *
+     * @exception NS_ERROR_FAILURE          there is no server registered
+     *                                      in the service with this key
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer
+     */
+    nsILDAPServer getServer(in wstring aKey);
+
+    /**
+     * Request a connection from the service, asynchronously. If there is
+     * one "cached" already, we will actually call the callback function
+     * before returning from this function. This might be considered a bug,
+     * but for now be aware of this (see Bugzilla bug #75989).
+     *
+     * Calling this method does not increment the leases on this connection,
+     * you'll have to use the getConnection() method to actually get the
+     * connection itself (presumably from the callback/listener object).
+     * The listener needs to implement nsILDAPMessageListener, providing
+     * the OnLDAPMessage() method.
+     * 
+     * @param aKey             unique key identifying the server entry
+     * @param aMessageListener the listener object, which we will call
+     *                         when the LDAP bind message is available
+     *
+     * @exception NS_ERROR_FAILURE          there is no server registered
+     *                                      in the service with this key,
+     *                                      or we were unable to get a
+     *                                      connection properly to the server
+     * @exception NS_ERROR_NOT_AVAILABLE	couldn't create connection thread
+     * @exception NS_ERROR_OUT_OF_MEMORY    ran out of memory
+     * @exception NS_ERROR_UNEXPECTED       unknown or unexpected error...
+     */
+    void requestConnection(in wstring aKey,
+                           in nsILDAPMessageListener aListener);
+
+    /**
+     * This is the nsLDAPConnection object related to this server.
+     * This does increase the lease counter on the object, so you have
+     * to call the releaseConnection() method to return it. It is
+     * important that you do this in matching pairs, and that you do
+     * not keep any dangling references to an object around after you
+     * have called the releaseConnection() method.
+     *
+     * @param aKey             unique key identifying the server entry
+     *
+     * @exception NS_ERROR_FAILURE          there is no server registered
+     *                                      in the service with this key
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer
+     */
+    nsILDAPConnection getConnection(in wstring aKey);
+
+    /**
+     * Release the lease on a (cached) LDAP connection, making it a
+     * potential candidate for disconnection. Note that this will not
+     * delete the actual LDAP server entry in the service, it's still
+     * registered and can be used in future calls to requestConnection().
+     *
+     * This API might be deprecated in the future, once we figure out how
+     * to use weak references to support our special needs for reference
+     * counting. For the time being, it is vital that you call this function
+     * when you're done with a Connection, and that you do not keep any
+     * copies of the Connection object lingering around.
+     *
+     * @param aKey             unique key identifying the server entry
+     *
+     * @exception NS_ERROR_FAILURE          there is no server registered
+     *                                      in the service with this key
+     * @exception NS_ERROR_OUT_OF_MEMORY    ran out of memory
+     */
+    void releaseConnection(in wstring aKey);
+
+    /**
+     * If we detect that a connection is broken (server disconnected us,
+     * or any other problem with the link), we need to try to reestablish
+     * the connection. This is very similar to requestConnection(),
+     * except you use this when detecting an error with a connection
+     * that is being cached.
+     *
+     * @param aKey             unique key identifying the server entry
+     * @param aMessageListener the listener object, which we will call
+     *                         when the LDAP bind message is available
+     *
+     * @exception NS_ERROR_FAILURE          there is no server registered
+     *                                      in the service with this key,
+     *                                      or we were unable to get a
+     *                                      connection properly to the server
+     * @exception NS_ERROR_NOT_AVAILABLE	couldn't create connection thread
+     * @exception NS_ERROR_OUT_OF_MEMORY    ran out of memory
+     * @exception NS_ERROR_UNEXPECTED       unknown or unexpected error...
+     */
+    void reconnectConnection(in wstring aKey,
+                             in nsILDAPMessageListener aListener);
+
+    /**
+     * Generates and returns an LDAP search filter by substituting
+     * aValue, aAttr, aPrefix, and aSuffix into aPattern.
+     *
+     * The only good documentation I'm aware of for this function is
+     * at <http://docs.iplanet.com/docs/manuals/dirsdk/csdk41/html/filter.htm>
+     * and 
+     * <http://docs.iplanet.com/docs/manuals/dirsdk/csdk41/html/function.htm#17835>
+     * Unfortunately, this does not currently seem to be available
+     * under any open source license, so I can't include that
+     * documentation here in the doxygen comments.
+     *
+     * @param aMaxSize   maximum size (in char) of string to be 
+     *                   created and returned (including final \0)
+     * @param aPattern   pattern to be used for the filter
+     * @param aPrefix    prefix to prepend to the filter
+     * @param aSuffix    suffix to be appended to the filer
+     * @param aAttr      replacement for %a in the pattern
+     * @param aValue     replacement for %v in the pattern
+     *  
+     * @exception NS_ERROR_INVALID_ARG      invalid parameter passed in
+     * @exception NS_ERROR_OUT_OF_MEMORY    allocation failed
+     * @exception NS_ERROR_NOT_AVAILABLE    filter longer than maxsiz chars
+     * @exception NS_ERROR_UNEXPECTED       ldap_create_filter returned
+     *                                      unexpected error code
+     */
+    AUTF8String createFilter(in unsigned long aMaxSize, in AUTF8String aPattern, 
+                             in AUTF8String aPrefix, in AUTF8String aSuffix,
+                             in AUTF8String aAttr, in AUTF8String aValue);
+
+    /**
+     * Parses a distinguished name (DN) and returns the relative DN,
+     * base DN and the list of attributes that make up the relative DN.
+     *
+     * @param dn        DN to parse
+     * @param rdn       The relative DN for the given DN
+     * @param baseDn    The base DN for the given DN
+     * @param rdnCount  Number of values in the outbound attributes array.
+     * @param rdnAttrs  Array of attribute names
+     *
+     */
+    void parseDn(in string dn, out AUTF8String rdn, out AUTF8String baseDn,
+                 out unsigned long rdnCount,
+                 [retval, array, size_is(rdnCount)] out string rdnAttrs);
+};
diff --git a/ldap/xpcom/public/nsILDAPSyncQuery.idl b/ldap/xpcom/public/nsILDAPSyncQuery.idl
new file mode 100644
index 000000000..2ae3307f0
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPSyncQuery.idl
@@ -0,0 +1,27 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+interface nsILDAPURL;
+
+
+[scriptable, uuid (0308fb36-1dd2-11b2-b16f-8510e8c5311a)]
+interface nsILDAPSyncQuery : nsISupports {
+  
+  /**
+   * getQueryResults
+   *
+   * Create a new LDAP connection do a synchronous LDAP search and return 
+   * the results.
+   * @param aServerURL - LDAP URL with parameters to a LDAP search 
+   *                     ("ldap://host/base?attributes?one/sub?filter")
+   * @param aProtocolVersion - LDAP protocol version to use for connection
+   *                           (nsILDAPConnection.idl has symbolic constants)
+   * @return results
+   */
+   wstring getQueryResults (in nsILDAPURL aServerURL,
+                            in unsigned long aProtocolVersion);
+
+};
diff --git a/ldap/xpcom/public/nsILDAPURL.idl b/ldap/xpcom/public/nsILDAPURL.idl
new file mode 100644
index 000000000..dae76496d
--- /dev/null
+++ b/ldap/xpcom/public/nsILDAPURL.idl
@@ -0,0 +1,132 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * 
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsIURI.idl"
+
+%{C++
+#define NS_LDAPURL_CONTRACTID "@mozilla.org/network/ldap-url;1"
+%}
+
+/**
+ * Strings in methods inherited from nsIURI, which are using XPIDL
+ * |string| types, are expected to be UTF8 encoded. All such strings
+ * in this interface, except attribute types (e.g. "cn"), should in fact
+ * be UTF8. It's important to remember that attributes can not be UTF8,
+ * they can only be of a limited subset of ASCII (see RFC 2251).
+ */
+
+[scriptable, uuid(8e3a6d33-2e68-40ba-8f94-6ac03f69066e)]
+interface nsILDAPURL : nsIURI {
+    /**
+     * Initialize an LDAP URL
+     *
+     * @param aUrlType       - one of the URLTYPE_ flags @seealso nsIStandardURL
+     * @param aDefaultPort   - if the port parsed from the URL string matches
+     *                         this port, then the port will be removed from the
+     *                         canonical form of the URL.
+     * @param aSpec          - URL string.
+     * @param aOriginCharset - the charset from which this URI string
+     *                         originated.  this corresponds to the charset
+     *                         that should be used when communicating this
+     *                         URI to an origin server, for example.  if
+     *                         null, then provide aBaseURI implements this
+     *                         interface, the origin charset of aBaseURI will
+     *                         be assumed, otherwise defaulting to UTF-8 (i.e.,
+     *                         no charset transformation from aSpec).
+     * @param aBaseURI       - if null, aSpec must specify an absolute URI.
+     *                         otherwise, aSpec will be resolved relative
+     *                         to aBaseURI.
+     */
+    void init(in unsigned long aUrlType,
+              in long aDefaultPort,
+              in AUTF8String aSpec,
+              in string aOriginCharset,
+              in nsIURI aBaseURI);
+
+    /**
+     * The distinguished name of the URL (ie the base DN for the search).
+     * This string is expected to be a valid UTF8 string.
+     *
+     * for the getter:
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     * @exception NS_ERROR_OUT_OF_MEMORY	Ran out of memory
+     */
+    attribute AUTF8String dn;
+
+    /**
+     * The attributes to get for this URL, in comma-separated format. If the
+     * list is empty, all attributes are requested.
+     */
+    attribute ACString attributes;
+
+    /**
+     * Add one attribute to the array of attributes to request. If the
+     * attribute is already in our array, this becomes a noop.
+     *
+     * @param aAttribute          An LDAP attribute (e.g. "cn")
+     */
+    void addAttribute(in ACString aAttribute);
+
+    /**
+     * Remove one attribute from the array of attributes to request. If
+     * the attribute didn't exist in the array, this becomes a noop.
+     *
+     * @param aAttribute                    An LDAP attribute (e.g. "cn")
+     * @exception NS_ERROR_OUT_OF_MEMORY	Ran out of memory
+     */
+    void removeAttribute(in ACString aAttribute);
+
+    /**
+     * Test if an attribute is in our list of attributes already
+     *
+     * @param aAttribute                    An LDAP attribute (e.g. "cn")
+     * @return boolean                      Truth value
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     */
+    boolean hasAttribute(in ACString aAttribute);
+
+    /**
+     * The scope of the search.  defaults to SCOPE_BASE. 
+     *
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     * @exception NS_ERROR_MALFORMED_URI	Illegal base to SET method
+     */
+    attribute long scope;
+
+    /**
+     * Search just the base object
+     */
+    const long SCOPE_BASE = 0;
+    
+    /** 
+     * Search only the children of the base object
+     */
+    const long SCOPE_ONELEVEL = 1;
+
+    /**
+     * Search the entire subtree under and including the base object
+     */
+    const long SCOPE_SUBTREE = 2;
+
+    /**
+     * The search filter. "(objectClass=*)" is the default.
+     */
+    attribute AUTF8String filter;
+
+    /**
+     * Any options defined for this URL (check options using a bitwise and)
+     * 
+     * @exception NS_ERROR_NULL_POINTER     NULL pointer to GET method
+     * @exception NS_ERROR_OUT_OF_MEMORY    Ran out of memory
+     */
+    attribute unsigned long options;
+
+    /**
+     * If this is set/true, this is an ldaps: URL, not an ldap: URL
+     */
+    const unsigned long OPT_SECURE = 0x01;
+};