draft-ietf-ldapbis-dn-10.txt   draft-ietf-ldapbis-dn-11.txt 
INTERNET-DRAFT Editor: Kurt D. Zeilenga INTERNET-DRAFT Editor: Kurt D. Zeilenga
Intended Category: Standard Track OpenLDAP Foundation Intended Category: Standard Track OpenLDAP Foundation
Expires in six months 4 May 2003 Expires in six months 30 June 2003
Obsoletes: 2253 Obsoletes: 2253
LDAP: String Representation of Distinguished Names LDAP: String Representation of Distinguished Names
<draft-ietf-ldapbis-dn-10.txt> <draft-ietf-ldapbis-dn-11.txt>
Status of Memo Status of Memo
This document is an Internet-Draft and is in full conformance with all This document is an Internet-Draft and is in full conformance with all
provisions of Section 10 of RFC2026. provisions of Section 10 of RFC2026.
This document is intended to be, after appropriate review and This document is intended to be, after appropriate review and
revision, submitted to the RFC Editor as a Standard Track document revision, submitted to the RFC Editor as a Standard Track document
replacing RFC 2253. Distribution of this memo is unlimited. replacing RFC 2253. Distribution of this memo is unlimited.
Technical discussion of this document will take place on the IETF LDAP Technical discussion of this document will take place on the IETF LDAP
Revision (LDAPbis) Working Group mailing list Revision (LDAPBIS) Working Group mailing list
<ietf-ldapbis@openldap.org>. Please send editorial comments directly <ietf-ldapbis@openldap.org>. Please send editorial comments directly
to the document editor <Kurt@OpenLDAP.org>. to the document editor <Kurt@OpenLDAP.org>.
Internet-Drafts are working documents of the Internet Engineering Task Internet-Drafts are working documents of the Internet Engineering Task
Force (IETF), its areas, and its working groups. Note that other Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts. groups may also distribute working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as ``work in progress.'' material or to cite them other than as ``work in progress.''
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
<http://www.ietf.org/ietf/1id-abstracts.txt>. The list of <http://www.ietf.org/ietf/1id-abstracts.txt>. The list of
Internet-Draft Shadow Directories can be accessed at Internet-Draft Shadow Directories can be accessed at
<http://www.ietf.org/shadow.html>. <http://www.ietf.org/shadow.html>.
Copyright 2003, The Internet Society. All Rights Reserved. Copyright (C) The Internet Society (2003). All Rights Reserved.
Please see the Copyright section near the end of this document for Please see the Full Copyright section near the end of this document
more information. for more information.
Abstract Abstract
The X.500 Directory uses distinguished names (DNs) as primary keys to The X.500 Directory uses distinguished names (DNs) as primary keys to
entries in the directory. This document defines the string entries in the directory. This document defines the string
representation used in the Lightweight Directory Access Protocol representation used in the Lightweight Directory Access Protocol
(LDAP) to transfer distinguished names. The string representation is (LDAP) to transfer distinguished names. The string representation is
designed to give a clean representation of commonly used distinguished designed to give a clean representation of commonly used distinguished
names, while being able to represent any distinguished name. names, while being able to represent any distinguished name.
Conventions Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in BCP 14 [RFC2119]. document are to be interpreted as described in BCP 14 [RFC2119].
1. Background and Intended Usage 1. Background and Intended Usage
In X.500-based directory systems [X.500], including those accessed In X.500-based directory systems [X.500], including those accessed
using the Lightweight Directory Access Protocol (LDAP) [Roadmap], using the Lightweight Directory Access Protocol (LDAP) [Roadmap],
distinguished names (DNs) are used to unambiguously refer to a distinguished names (DNs) are used to unambiguously refer to directory
directory entry [X.501][Models]. entries [X.501][Models].
The structure of a DN [X.501] is described in terms of ASN.1 [X.680]. The structure of a DN [X.501] is described in terms of ASN.1 [X.680].
In the X.500 Directory Access Protocol [X.511] (and other ITU-defined In the X.500 Directory Access Protocol [X.511] (and other ITU-defined
directory protocols), DNs are encoded using the Basic Encoding Rules directory protocols), DNs are encoded using the Basic Encoding Rules
(BER) [X.690]. In LDAP, DNs are represented in string form. (BER) [X.690]. In LDAP, DNs are represented in string form.
It is important to have a common format to be able to unambiguously It is important to have a common format to be able to unambiguously
represent a distinguished name. The primary goal of this represent a distinguished name. The primary goal of this
specification is ease of encoding and decoding. A secondary goal is specification is ease of encoding and decoding. A secondary goal is
to have names that are human readable. It is not expected that LDAP to have names that are human readable. It is not expected that LDAP
implementations with a human user interface would display these implementations with a human user interface would display these
strings directly to the user, but would most likely be performing strings directly to the user, but would most likely be performing
translations (such as expressing attribute type names in one of the translations (such as expressing attribute type names in the local
local national languages). national language).
This document defines the string representation of Distinguished Names This document defines the string representation of Distinguished Names
used in LDAP [Protocol][Syntaxes]. Section 2 details the RECOMMENDED used in LDAP [Protocol][Syntaxes]. Section 2 details the RECOMMENDED
algorithm for converting a DN from its ASN.1 structured representation algorithm for converting a DN from its ASN.1 structured representation
to a string. Section 3 details how to convert a DN from a string to a to a string. Section 3 details how to convert a DN from a string to a
ASN.1 structured representation. ASN.1 structured representation.
While other documents may define other algorithms for converting a DN While other documents may define other algorithms for converting a DN
from its ASN.1 structured representation to a string, all algorithms from its ASN.1 structured representation to a string, all algorithms
MUST produce strings which adhere to the requirements of Section 3. MUST produce strings which adhere to the requirements of Section 3.
skipping to change at page 3, line 29 skipping to change at page 3, line 29
RelativeDistinguishedName ::= SET SIZE (1..MAX) OF RelativeDistinguishedName ::= SET SIZE (1..MAX) OF
AttributeTypeAndValue AttributeTypeAndValue
AttributeTypeAndValue ::= SEQUENCE { AttributeTypeAndValue ::= SEQUENCE {
type AttributeType, type AttributeType,
value AttributeValue } value AttributeValue }
This section defines the RECOMMENDED algorithm for converting a This section defines the RECOMMENDED algorithm for converting a
distinguished name from an ASN.1 structured representation to an UTF-8 distinguished name from an ASN.1 structured representation to an UTF-8
[RFC2279] encoded Universal Character Set (UCS) [ISO10646] character [UTF-8] encoded Universal Character Set (UCS) [ISO10646] character
string representation. Other documents may describe other algorithms string representation. Other documents may describe other algorithms
for converting a distinguished name to a string, but only strings for converting a distinguished name to a string, but only strings
which conform to the grammar defined in Section 3 MUST be produced by which conform to the grammar defined in Section 3 MUST be produced by
LDAP implementations. LDAP implementations.
2.1. Converting the RDNSequence 2.1. Converting the RDNSequence
If the RDNSequence is an empty sequence, the result is the empty or If the RDNSequence is an empty sequence, the result is the empty or
zero length string. zero length string.
skipping to change at page 4, line 20 skipping to change at page 4, line 20
character. character.
2.3. Converting AttributeTypeAndValue 2.3. Converting AttributeTypeAndValue
The AttributeTypeAndValue is encoded as the string representation of The AttributeTypeAndValue is encoded as the string representation of
the AttributeType, followed by an equals ("=" U+003D) character, the AttributeType, followed by an equals ("=" U+003D) character,
followed by the string representation of the AttributeValue. The followed by the string representation of the AttributeValue. The
encoding of the AttributeValue is given in Section 2.4. encoding of the AttributeValue is given in Section 2.4.
If the AttributeType is defined to have a short name and that short If the AttributeType is defined to have a short name and that short
name is known to be registered [REGISTRY] as identifying the name is known to be registered [REGISTRY][BCP64bis] as identifying the
AttributeType, that short name, a <descr>, is used. Otherwise the AttributeType, that short name, a <descr>, is used. Otherwise the
AttributeType is encoded as the dotted-decimal encoding, a AttributeType is encoded as the dotted-decimal encoding, a
<numericoid>, of its OBJECT IDENTIFIER. The <descr> and <numericoid> <numericoid>, of its OBJECT IDENTIFIER. The <descr> and <numericoid>
is defined in [Models]. is defined in [Models].
Implementations are not expected dynamically update their knowledge of Implementations are not expected to dynamically update their knowledge
registered short names. However, implementations SHOULD provide a of registered short names. However, implementations SHOULD provide a
mechanism to allow its knowledge of registered short names to be mechanism to allow its knowledge of registered short names to be
updated. updated.
2.4. Converting an AttributeValue from ASN.1 to a String 2.4. Converting an AttributeValue from ASN.1 to a String
If the AttributeType is of the dotted-decimal form, the AttributeValue If the AttributeType is of the dotted-decimal form, the AttributeValue
is represented by an number sign ("#" U+0023) character followed by is represented by an number sign ("#" U+0023) character followed by
the hexadecimal encoding of each of the octets of the BER encoding of the hexadecimal encoding of each of the octets of the BER encoding of
the X.500 AttributeValue. This form is also used when the syntax of the X.500 AttributeValue. This form is also used when the syntax of
the AttributeValue does not have a native string encoding defined for the AttributeValue does not have a native string encoding defined for
skipping to change at page 5, line 35 skipping to change at page 5, line 35
(U+0020, U+0022, U+0023, U+002B, U+002C, U+003B, (U+0020, U+0022, U+0023, U+002B, U+002C, U+003B,
U+003C, U+003D, U+003E, U+005C respectively) U+003C, U+003D, U+003E, U+005C respectively)
it can be prefixed by a backslash ("\" U+0005C). it can be prefixed by a backslash ("\" U+0005C).
Examples of the escaping mechanism are shown in Section 4. Examples of the escaping mechanism are shown in Section 4.
3. Parsing a String back to a Distinguished Name 3. Parsing a String back to a Distinguished Name
The string representation of Distinguished Names is restricted to The string representation of Distinguished Names is restricted to
UTF-8 [RFC2279] encoded characters from the Universal Character Set UTF-8 [UTF-8] encoded characters from the Universal Character Set
(UCS) [ISO10646]. The structure of this string representation is (UCS) [ISO10646]. The structure of this string representation is
specified using the following Augmented BNF [RFC2234] grammar: specified using the following Augmented BNF [RFC2234] grammar:
distinguishedName = [ relativeDistinguishedName distinguishedName = [ relativeDistinguishedName
*( COMMA relativeDistinguishedName ) ] *( COMMA relativeDistinguishedName ) ]
relativeDistinguishedName = attributeTypeAndValue relativeDistinguishedName = attributeTypeAndValue
*( PLUS attributeTypeAndValue ) *( PLUS attributeTypeAndValue )
attributeTypeAndValue = attributeType EQUALS attributeValue attributeTypeAndValue = attributeType EQUALS attributeValue
skipping to change at page 9, line 41 skipping to change at page 9, line 41
This document is a product of the IETF LDAPBIS Working Group. This document is a product of the IETF LDAPBIS Working Group.
7. Document Editor's Address 7. Document Editor's Address
Kurt D. Zeilenga Kurt D. Zeilenga
OpenLDAP Foundation OpenLDAP Foundation
<Kurt@OpenLDAP.org> <Kurt@OpenLDAP.org>
8. Normative References 8. Normative References
[X.501] "The Directory -- Models," ITU-T Rec. X.501(1993). [X.501] International Telecommunication Union -
Telecommunication Standardization Sector, "The Directory
-- Models," X.501(1993) (also ISO/IEC 9594-2:1994).
[X.680] ITU-T, "Abstract Syntax Notation One (ASN.1) - [X.680] International Telecommunication Union -
Specification of Basic Notation", X.680, 1994. Telecommunication Standardization Sector, "Abstract
Syntax Notation One (ASN.1) - Specification of Basic
Notation", X.680(1997) (also ISO/IEC 8824-1:1998).
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14 (also RFC 2119). Requirement Levels", BCP 14 (also RFC 2119), March 1997.
[RFC2234] Crocker, D., and P. Overell, "Augmented BNF for Syntax [RFC2234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", RFC 2234, November 1997. Specifications: ABNF", RFC 2234, November 1997.
[RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO [UTF-8] Yergeau, F., "UTF-8, a transformation
10646", RFC 2279, January 1998. format of ISO 10646", draft-yergeau-rfc2279bis, a work
in progress.
[Models] K. Zeilenga (editor), "LDAP: Directory Information [Models] Zeilenga, K. (editor), "LDAP: Directory Information
Models", draft-ietf-ldapbis-models-xx.txt, a work in Models", draft-ietf-ldapbis-models-xx.txt, a work in
progress. progress.
[Roadmap] K. Zeilenga, "LDAP: Technical Specification Road Map", [Roadmap] Zeilenga, K. (editor), "LDAP: Technical Specification
draft-ietf-ldapbis-roadmap-xx.txt, a work in progress. Road Map", draft-ietf-ldapbis-roadmap-xx.txt, a work in
progress.
[Protocol] J. Sermersheim (editor), "LDAP: The Protocol", [Protocol] Sermersheim, J. (editor), "LDAP: The Protocol",
draft-ietf-ldapbis-protocol-xx.txt, a work in progress. draft-ietf-ldapbis-protocol-xx.txt, a work in progress.
[Syntaxes] S. Legg (editor), "LDAP: Syntaxes", [Syntaxes] Legg, S. (editor), "LDAP: Syntaxes and Matching Rules",
draft-ietf-ldapbis-syntaxes-xx.txt, a work in progress. draft-ietf-ldapbis-syntaxes-xx.txt, a work in progress.
[Schema] K. Dally (editor), "LDAP: User Schema", [Schema] Dally, K. (editor), "LDAP: User Schema",
draft-ietf-ldapbis-user-schema-xx.txt, a work in draft-ietf-ldapbis-user-schema-xx.txt, a work in
progress. progress.
[ISO10646] Universal Multiple-Octet Coded Character Set (UCS) - [ISO10646] International Organization for Standardization,
Architecture and Basic Multilingual Plane, ISO/IEC "Universal Multiple-Octet Coded Character Set (UCS) -
Architecture and Basic Multilingual Plane", ISO/IEC
10646-1 : 1993. 10646-1 : 1993.
9. Informative References [REGISTRY] IANA, Object Identifier Descriptors
Registry, <http://www.iana.org/...>.
[X.500] "The Directory -- overview of concepts, models and 9. Informative References
services," ITU-T Rec. X.500(1993).
[X.690] ITU-T, "Specification of ASN.1 encoding rules: Basic, [X.500] International Telecommunication Union -
Canonical, and Distinguished Encoding Rules", X.690, Telecommunication Standardization Sector, "The Directory
1994. -- Overview of concepts, models and services,"
X.500(1993) (also ISO/IEC 9594-1:1994).
[RFC3383] K. Zeilenga, "IANA Considerations for LDAP", BCP 64 (also [X.690] International Telecommunication Union -
RFC 3383), September 2002. Telecommunication Standardization Sector, "Specification
of ASN.1 encoding rules: Basic Encoding Rules (BER),
Canonical Encoding Rules (CER), and Distinguished
Encoding Rules (DER)", X.690(1997) (also ISO/IEC
8825-1:1998).
[RFC2849] G. Good, "The LDAP Data Interchange Format (LDIF) - [RFC2849] Good, G., "The LDAP Data Interchange Format (LDIF) -
Technical Specification", RFC 2849, June 2000. Technical Specification", RFC 2849, June 2000.
[BCP64bis] Zeilenga, K., "IANA Considerations for LDAP", draft-
ietf-ldapbis-bcp64-xx.txt, a work in progress.
Appendix A. Presentation Issues Appendix A. Presentation Issues
This appendix is provided for informational purposes only, it is not a This appendix is provided for informational purposes only, it is not a
normative part of this specification. normative part of this specification.
The string representation described in this document is not intended The string representation described in this document is not intended
to be presented to humans without translation. However, at times it to be presented to humans without translation. However, at times it
may be desirable to present non-translated DN strings to users. This may be desirable to present non-translated DN strings to users. This
section discusses presentation issues associated with non-translated section discusses presentation issues associated with non-translated
DN strings. Presentation of translated DN strings issues are not DN strings. Presentation of translated DN strings issues are not
skipping to change at page 12, line 26 skipping to change at page 12, line 40
SN: Zeilenga SN: Zeilenga
objectClass: person objectClass: person
Appendix B. Changes made since RFC 2253 Appendix B. Changes made since RFC 2253
This appendix is provided for informational purposes only, it is not a This appendix is provided for informational purposes only, it is not a
normative part of this specification. normative part of this specification.
The following substantive changes were made to RFC 2253: The following substantive changes were made to RFC 2253:
- Removed IESG Note. The IESG Note has been addressed. - Removed IESG Note. The IESG Note has been addressed.
- Clarified (in Section 1), that this document does not define a - Clarified (in Section 1) that this document does not define a
canonical string representation. canonical string representation.
- Revised specification (in Section 2) to allow short names of any
registered attribute type to appear in string representations of
DNs instead of being restricted to a "published table". Remove
"as an example" language. Added statement (in Section 3) allowing
recognition of additional names but require recognization of those
names in the published table. The table is now published in
Section 3.
- Replaced specification of additional requirements for LDAPv2 - Replaced specification of additional requirements for LDAPv2
implementations which also support LDAPv3 (RFC 2253, Section 4) implementations which also support LDAPv3 (RFC 2253, Section 4)
with a statement (in Section 3) allowing recognition of with a statement (in Section 3) allowing recognition of
alternative string representations. alternative string representations.
- Clarified (in Section 2.3) that the "published" table of names
which may be appear in DNs is the table which Section 2.3
provides. Remove "as an example" language. Noted this table is
not extensible. Added statement (in Section 3) allowing
recognition of additional names. Added security considerations
(Section 5.3) regarding the use of other names.
- Updated Section 2.3 to indicate attribute type name strings are - Updated Section 2.3 to indicate attribute type name strings are
case insensitive. case insensitive.
- Updated Section 2.4 to allow hex pair escaping of all characters - Updated Section 2.4 to allow hex pair escaping of all characters
and clarified escaping for when multiple octet UTF-8 characters and clarified escaping for when multiple octet UTF-8 characters
are present. are present.
- Rewrote Section 3 to use ABNF as defined in RFC 2234. - Rewrote Section 3 to use ABNF as defined in RFC 2234.
- Rewrote Section 3 ABNF to be consistent with 2.4. - Rewrote Section 3 ABNF to be consistent with 2.4.
- Updated Section 3 to describe how to parse elements of the - Updated Section 3 to describe how to parse elements of the
grammar. grammar.
- Rewrote examples. - Rewrote examples.
- Added reference to documentations containing general LDAP security - Added reference to documentations containing general LDAP security
considerations. considerations.
- Added discussion of presentation issues (Appendix A). - Added discussion of presentation issues (Appendix A).
- Added this appendix. - Added this appendix.
In addition, numerous editorial changes were made. In addition, numerous editorial changes were made.
Copyright 2003, The Internet Society. All Rights Reserved. Intellectual Property Rights
The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to pertain
to the implementation or use of the technology described in this
document or the extent to which any license under such rights might or
might not be available; neither does it represent that it has made any
effort to identify any such rights. Information on the IETF's
procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. Copies of
claims of rights made available for publication and any assurances of
licenses to be made available, or the result of an attempt made to
obtain a general license or permission for the use of such proprietary
rights by implementors or users of this specification can be obtained
from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive
Director.
Full Copyright
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished to This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published and or assist in its implmentation may be prepared, copied, published and
distributed, in whole or in part, without restriction of any kind, distributed, in whole or in part, without restriction of any kind,
provided that the above copyright notice and this paragraph are provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be followed, copyrights defined in the Internet Standards process must be followed,
or as required to translate it into languages other than English. or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE AUTHORS, THE INTERNET SOCIETY, AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/