PermissiveModifyControl throws DirectoryOperationException in C# LDAP

Question

Using the System.DirectoryServices.Protocols namespace to add/modify attributes on an Active Directory group. Code:

public void UpdateProperties(Dictionary<string, string> Properties) {

    List<DirectoryAttributeModification> directoryAttributeModifications;

    //  ... Code to convert Properties dictionary to directoryAttributeModifications
    //  There is one 'Add' modification, to set the 'description' of the group

    ModifyRequest modifyRequest = new ModifyRequest(groupDistinguishedName, directoryAttributeModifications.ToArray());
    modifyRequest.Controls.Add(new PermissiveModifyControl());
    ModifyResponse response = connection.SendRequest(modifyRequest) as ModifyResponse;

The PermissiveModifyControl is intended to keep the code from failing if the description already exists. The only information on PermissiveModifyControl I've found is here: http://msdn.microsoft.com/en-us/library/bb332056.aspx

which states:

An LDAP modify request will normally fail if it attempts to add an attribute that already exists or if it attempts to delete an attribute that does not exist. With PermissiveModifyControl the modify operation succeeds without throwing a DirectoryOperationException error.

However, when the above code gets to the SendRequest(), it throws a DirectoryOperationException: "The attribute exists or the value has been assigned."

What I'm trying to avoid is having to query every property in the collection being passed; if it exists, create a Replace DirectoryAttributeModification; if it doesn't, create an Add instead. From what I can glean, PermissiveModifyControl is supposed to do just that.

Can anyone shed some light on why PermissiveModifyControl still throws a DirectoryOperationException, and how to properly use it?

Thanks in advance! James

Answer 1

After some more experimenting, I've found that the documentation is misleading... you don't want to add an attribute, you want to replace it (DirectoryAttributeOperation.Replace). If the attribute exists, it will of course replace it. If the attribute does not exist, it will create it.

The rest of my code is correct.