draft-ietf-ldapbis-dn-12.txt   draft-ietf-ldapbis-dn-13.txt 
INTERNET-DRAFT Editor: Kurt D. Zeilenga INTERNET-DRAFT Editor: Kurt D. Zeilenga
Intended Category: Standard Track OpenLDAP Foundation Intended Category: Standard Track OpenLDAP Foundation
Expires in six months 27 October 2003 Expires in six months 15 February 2004
Obsoletes: 2253 Obsoletes: 2253
LDAP: String Representation of Distinguished Names LDAP: String Representation of Distinguished Names
<draft-ietf-ldapbis-dn-12.txt> <draft-ietf-ldapbis-dn-13.txt>
Status of Memo Status of Memo
This document is an Internet-Draft and is in full conformance with all This document is an Internet-Draft and is in full conformance with all
provisions of Section 10 of RFC2026. provisions of Section 10 of RFC2026.
This document is intended to be, after appropriate review and This document is intended to be, after appropriate review and
revision, submitted to the RFC Editor as a Standard Track document revision, submitted to the RFC Editor as a Standard Track document
replacing RFC 2253. Distribution of this memo is unlimited. replacing RFC 2253. Distribution of this memo is unlimited.
Technical discussion of this document will take place on the IETF LDAP Technical discussion of this document will take place on the IETF LDAP
skipping to change at page 1, line 37 skipping to change at page 1, line 37
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as ``work in progress.'' material or to cite them other than as ``work in progress.''
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
<http://www.ietf.org/ietf/1id-abstracts.txt>. The list of <http://www.ietf.org/ietf/1id-abstracts.txt>. The list of
Internet-Draft Shadow Directories can be accessed at Internet-Draft Shadow Directories can be accessed at
<http://www.ietf.org/shadow.html>. <http://www.ietf.org/shadow.html>.
Copyright (C) The Internet Society (2003). All Rights Reserved. Copyright (C) The Internet Society (2004). All Rights Reserved.
Please see the Full Copyright section near the end of this document Please see the Full Copyright section near the end of this document
for more information. for more information.
Abstract Abstract
The X.500 Directory uses distinguished names (DNs) as primary keys to The X.500 Directory uses distinguished names (DNs) as primary keys to
entries in the directory. This document defines the string entries in the directory. This document defines the string
representation used in the Lightweight Directory Access Protocol representation used in the Lightweight Directory Access Protocol
(LDAP) to transfer distinguished names. The string representation is (LDAP) to transfer distinguished names. The string representation is
designed to give a clean representation of commonly used distinguished designed to give a clean representation of commonly used distinguished
names, while being able to represent any distinguished name. names, while being able to represent any distinguished name.
Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in BCP 14 [RFC2119].
1. Background and Intended Usage 1. Background and Intended Usage
In X.500-based directory systems [X.500], including those accessed In X.500-based directory systems [X.500], including those accessed
using the Lightweight Directory Access Protocol (LDAP) [Roadmap], using the Lightweight Directory Access Protocol (LDAP) [Roadmap],
distinguished names (DNs) are used to unambiguously refer to directory distinguished names (DNs) are used to unambiguously refer to directory
entries [X.501][Models]. entries [X.501][Models].
The structure of a DN [X.501] is described in terms of ASN.1 [X.680]. The structure of a DN [X.501] is described in terms of ASN.1 [X.680].
In the X.500 Directory Access Protocol [X.511] (and other ITU-defined In the X.500 Directory Access Protocol [X.511] (and other ITU-defined
directory protocols), DNs are encoded using the Basic Encoding Rules directory protocols), DNs are encoded using the Basic Encoding Rules
skipping to change at page 3, line 10 skipping to change at page 2, line 51
While other documents may define other algorithms for converting a DN While other documents may define other algorithms for converting a DN
from its ASN.1 structured representation to a string, all algorithms from its ASN.1 structured representation to a string, all algorithms
MUST produce strings which adhere to the requirements of Section 3. MUST produce strings which adhere to the requirements of Section 3.
This document does not define a canonical string representation for This document does not define a canonical string representation for
DNs. Comparison of DNs for equality is to be performed in accordance DNs. Comparison of DNs for equality is to be performed in accordance
with the distinguishedNameMatch matching rule [Syntaxes]. with the distinguishedNameMatch matching rule [Syntaxes].
This document is an integral part of the LDAP Technical Specification This document is an integral part of the LDAP Technical Specification
[Roadmap]. [Roadmap]. This document obsoletes RFC 2253. Changes since RFC 2253
are summarized in Appendix B.
This document obsoletes RFC 2253. Changes since RFC 2253 are
summarized in Appendix B.
This specification assumes familiarity with X.500 [X.500], and the This specification assumes familiarity with X.500 [X.500] and the
concept of Distinguished Name [X.501][Models]. concept of Distinguished Name [X.501][Models].
1.1. Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in BCP 14 [RFC2119].
Character names in this document use the notation for code points and
names from the Unicode Standard [Unicode]. For example, the letter
"a" may be represented as either <U+0061> or <LATIN SMALL LETTER A>.
Note: a glossary of terms used in Unicode can be found in [Glossary].
Information on the Unicode character encoding model can be found in
[CharModel].
2. Converting DistinguishedName from ASN.1 to a String 2. Converting DistinguishedName from ASN.1 to a String
X.501 [X.501] defines the ASN.1 [X.680] structure of distinguished X.501 [X.501] defines the ASN.1 [X.680] structure of distinguished
name. The following is a variant provided for discussion purposes. name. The following is a variant provided for discussion purposes.
DistinguishedName ::= RDNSequence DistinguishedName ::= RDNSequence
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::= SET SIZE (1..MAX) OF RelativeDistinguishedName ::= SET SIZE (1..MAX) OF
AttributeTypeAndValue AttributeTypeAndValue
AttributeTypeAndValue ::= SEQUENCE { AttributeTypeAndValue ::= SEQUENCE {
type AttributeType, type AttributeType,
value AttributeValue } value AttributeValue }
This section defines the RECOMMENDED algorithm for converting a This section defines the RECOMMENDED algorithm for converting a
distinguished name from an ASN.1 structured representation to an UTF-8 distinguished name from an ASN.1 structured representation to an UTF-8
[UTF-8] encoded Universal Character Set (UCS) [ISO10646] character [RFC3629] encoded Unicode [Unicode] character string representation.
string representation. Other documents may describe other algorithms Other documents may describe other algorithms for converting a
for converting a distinguished name to a string, but only strings distinguished name to a string, but only strings which conform to the
which conform to the grammar defined in Section 3 MUST be produced by grammar defined in Section 3 SHALL be produced by LDAP
LDAP implementations. implementations.
2.1. Converting the RDNSequence 2.1. Converting the RDNSequence
If the RDNSequence is an empty sequence, the result is the empty or If the RDNSequence is an empty sequence, the result is the empty or
zero length string. zero length string.
Otherwise, the output consists of the string encodings of each Otherwise, the output consists of the string encodings of each
RelativeDistinguishedName in the RDNSequence (according to Section RelativeDistinguishedName in the RDNSequence (according to Section
2.2), starting with the last element of the sequence and moving 2.2), starting with the last element of the sequence and moving
backwards toward the first. backwards toward the first.
The encodings of adjoining RelativeDistinguishedNames are separated by The encodings of adjoining RelativeDistinguishedNames are separated by
a comma ("," U+002C) character. a comma (',' U+002C) character.
2.2. Converting RelativeDistinguishedName 2.2. Converting RelativeDistinguishedName
When converting from an ASN.1 RelativeDistinguishedName to a string, When converting from an ASN.1 RelativeDistinguishedName to a string,
the output consists of the string encodings of each the output consists of the string encodings of each
AttributeTypeAndValue (according to Section 2.3), in any order. AttributeTypeAndValue (according to Section 2.3), in any order.
Where there is a multi-valued RDN, the outputs from adjoining Where there is a multi-valued RDN, the outputs from adjoining
AttributeTypeAndValues are separated by a plus sign ("+" U+002B) AttributeTypeAndValues are separated by a plus sign ('+' U+002B)
character. character.
2.3. Converting AttributeTypeAndValue 2.3. Converting AttributeTypeAndValue
The AttributeTypeAndValue is encoded as the string representation of The AttributeTypeAndValue is encoded as the string representation of
the AttributeType, followed by an equals ("=" U+003D) character, the AttributeType, followed by an equals ('=' U+003D) character,
followed by the string representation of the AttributeValue. The followed by the string representation of the AttributeValue. The
encoding of the AttributeValue is given in Section 2.4. encoding of the AttributeValue is given in Section 2.4.
If the AttributeType is defined to have a short name and that short If the AttributeType is defined to have a short name and that short
name is known to be registered [REGISTRY][BCP64bis] as identifying the name is known to be registered [REGISTRY][BCP64bis] as identifying the
AttributeType, that short name, a <descr>, is used. Otherwise the AttributeType, that short name, a <descr>, is used. Otherwise the
AttributeType is encoded as the dotted-decimal encoding, a AttributeType is encoded as the dotted-decimal encoding, a
<numericoid>, of its OBJECT IDENTIFIER. The <descr> and <numericoid> <numericoid>, of its OBJECT IDENTIFIER. The <descr> and <numericoid>
is defined in [Models]. is defined in [Models].
Implementations are not expected to dynamically update their knowledge Implementations are not expected to dynamically update their knowledge
of registered short names. However, implementations SHOULD provide a of registered short names. However, implementations SHOULD provide a
mechanism to allow its knowledge of registered short names to be mechanism to allow its knowledge of registered short names to be
updated. updated.
2.4. Converting an AttributeValue from ASN.1 to a String 2.4. Converting an AttributeValue from ASN.1 to a String
If the AttributeType is of the dotted-decimal form, the AttributeValue If the AttributeType is of the dotted-decimal form, the AttributeValue
is represented by an number sign ("#" U+0023) character followed by is represented by an number sign ('#' U+0023) character followed by
the hexadecimal encoding of each of the octets of the BER encoding of the hexadecimal encoding of each of the octets of the BER encoding of
the X.500 AttributeValue. This form is also used when the syntax of the X.500 AttributeValue. This form is also used when the syntax of
the AttributeValue does not have a native string encoding defined for the AttributeValue does not have a LDAP-specific [Syntaxes, Section
it or the native string encoding is not restricted to UTF-8 encoded 3.1] string encoding defined for it or the LDAP-specific string
UCS (or a subset of UCS) characters. This form may also be used in encoding is not restricted to UTF-8 encoded Unicode characters. This
other cases, such as when a reversible string representation is form may also be used in other cases, such as when a reversible string
desired (see Section 5.2). representation is desired (see Section 5.2).
Otherwise, if the AttributeValue is of a syntax which has a native Otherwise, if the AttributeValue is of a syntax which has a
string encoding, the value is converted first to a UTF-8 encoded UCS LDAP-specific string encoding, the value is converted first to a UTF-8
string according to its syntax specification (see for example Section encoded Unicode string according to its syntax specification (see
6 of [Syntaxes]). If that UTF-8 encoded UCS string does not have any [Syntaxes, Section 3.3] for examples). If that UTF-8 encoded Unicode
of the following characters which need escaping, then that string can string does not have any of the following characters which need
be used as the string representation of the value. escaping, then that string can be used as the string representation of
the value.
- a space (" " U+0020) or number sign ("#" U+0023) occurring at - a space (' ' U+0020) or number sign ('#' U+0023) occurring at
the beginning of the string; the beginning of the string;
- a space (" " U+0020) character occurring at the end of the - a space (' ' U+0020) character occurring at the end of the
string; string;
- one of the characters """, "+", ",", ";", "<", ">", or "\" - one of the characters '"', '+', ',', ';', '<', '>', or '\'
(U+0022, U+002B, U+002C, U+003B, U+003C, U+003E, or U+005C (U+0022, U+002B, U+002C, U+003B, U+003C, U+003E, or U+005C
respectively); respectively);
- the null (U+0000) character. - the null (U+0000) character.
Other characters may be escaped. Other characters may be escaped.
Each octet of the character to be escaped is replaced by a backslash Each octet of the character to be escaped is replaced by a backslash
and two hex digits, which form a single octet in the code of the and two hex digits, which form a single octet in the code of the
character. Alternatively, if and only if the character to be escaped character. Alternatively, if and only if the character to be escaped
is one of is one of
" ", """, "#", "+", ",", ";", "<", "=", ">", or "\" ' ', '"', '#', '+', ',', ';', '<', '=', '>', or '\'
(U+0020, U+0022, U+0023, U+002B, U+002C, U+003B, (U+0020, U+0022, U+0023, U+002B, U+002C, U+003B,
U+003C, U+003D, U+003E, U+005C respectively) U+003C, U+003D, U+003E, U+005C respectively)
it can be prefixed by a backslash ("\" U+0005C). it can be prefixed by a backslash ('\' U+0005C).
Examples of the escaping mechanism are shown in Section 4. Examples of the escaping mechanism are shown in Section 4.
3. Parsing a String back to a Distinguished Name 3. Parsing a String back to a Distinguished Name
The string representation of Distinguished Names is restricted to The string representation of Distinguished Names is restricted to
UTF-8 [UTF-8] encoded characters from the Universal Character Set UTF-8 [RFC3629] encoded Unicode [Unicode] characters. The structure
(UCS) [ISO10646]. The structure of this string representation is of this string representation is specified using the following
specified using the following Augmented BNF [RFC2234] grammar: Augmented BNF [RFC2234] grammar:
distinguishedName = [ relativeDistinguishedName distinguishedName = [ relativeDistinguishedName
*( COMMA relativeDistinguishedName ) ] *( COMMA relativeDistinguishedName ) ]
relativeDistinguishedName = attributeTypeAndValue relativeDistinguishedName = attributeTypeAndValue
*( PLUS attributeTypeAndValue ) *( PLUS attributeTypeAndValue )
attributeTypeAndValue = attributeType EQUALS attributeValue attributeTypeAndValue = attributeType EQUALS attributeValue
attributeType = descr / numericoid attributeType = descr / numericoid
attributeValue = string / hexstring attributeValue = string / hexstring
; The UTF-8 string shall not contain NULL, ESC, or ; The following characters are to be escaped when they appear
; one of escaped, shall not start with SHARP or SPACE, ; in the value to be encoded: ESC, one of <escaped>, leading
; and shall must not end with SPACE. ; SHARP or SPACE, trailing SPACE, and NULL.
string = [ (leadchar / pair) string = [ (leadchar / pair)
[ *( stringchar / pair ) ( trailchar / pair ) ] ] [ *( stringchar / pair ) ( trailchar / pair ) ] ]
leadchar = LUTF1 / UTFMB leadchar = LUTF1 / UTFMB
LUTF1 = %x01-1F / %x21 / %x24-2A / %x2D-3A / LUTF1 = %x01-1F / %x21 / %x24-2A / %x2D-3A /
%x3D / %x3F-5B / %x5D-7F %x3D / %x3F-5B / %x5D-7F
trailchar = TUTF1 / UTFMB trailchar = TUTF1 / UTFMB
TUTF1 = %x01-1F / %x21 / %x23-2A / %x2D-3A / TUTF1 = %x01-1F / %x21 / %x23-2A / %x2D-3A /
%x3D / %x3F-5B / %x5D-7F %x3D / %x3F-5B / %x5D-7F
skipping to change at page 7, line 31 skipping to change at page 7, line 32
CN commonName (2.5.4.3) CN commonName (2.5.4.3)
L localityName (2.5.4.7) L localityName (2.5.4.7)
ST stateOrProvinceName (2.5.4.8) ST stateOrProvinceName (2.5.4.8)
O organizationName (2.5.4.10) O organizationName (2.5.4.10)
OU organizationalUnitName (2.5.4.11) OU organizationalUnitName (2.5.4.11)
C countryName (2.5.4.6) C countryName (2.5.4.6)
STREET streetAddress (2.5.4.9) STREET streetAddress (2.5.4.9)
DC domainComponent (0.9.2342.19200300.100.1.25) DC domainComponent (0.9.2342.19200300.100.1.25)
UID userId (0.9.2342.19200300.100.1.1) UID userId (0.9.2342.19200300.100.1.1)
Implementations MAY recognize other DN string representations Implementations MAY recognize other DN string representations (such as
(such as that described in RFC 1779). However, as there is no that described in RFC 1779). However, as there is no requirement that
requirement that alternative DN string representations to be alternative DN string representations to be recognized (and, if so,
recognized (and, if so, how), implementations SHOULD only generate how), implementations SHOULD only generate DN strings in accordance
DN strings in accordance with Section 2 of this document. with Section 2 of this document.
4. Examples 4. Examples
This notation is designed to be convenient for common forms of This notation is designed to be convenient for common forms of name.
name. This section gives a few examples of distinguished names This section gives a few examples of distinguished names written using
written using this notation. First is a name containing three this notation. First is a name containing three relative
relative distinguished names (RDNs): distinguished names (RDNs):
UID=jsmith,DC=example,DC=net UID=jsmith,DC=example,DC=net
Here is an example name containing three RDNs, in which the first Here is an example name containing three RDNs, in which the first RDN
RDN is multi-valued: is multi-valued:
OU=Sales+CN=J. Smith,DC=example,DC=net OU=Sales+CN=J. Smith,DC=example,DC=net
This example shows the method of escaping of a comma in a common name:
This example shows the method of escaping of a comma in a common
name:
CN=John Smith\, III,DC=example,DC=net CN=John Smith\, III,DC=example,DC=net
An example name in which a value contains a carriage return An example name in which a value contains a carriage return character:
character:
CN=Before\0dAfter,DC=example,DC=net CN=Before\0dAfter,DC=example,DC=net
An example name in which an RDN was of an unrecognized type. The An example name in which an RDN was of an unrecognized type. The
value is the BER encoding of an OCTET STRING containing two octets value is the BER encoding of an OCTET STRING containing two octets
0x48 and 0x69. 0x48 and 0x69.
1.3.6.1.4.1.1466.0=#04024869,DC=example,DC=com 1.3.6.1.4.1.1466.0=#04024869,DC=example,DC=com
Finally, an example of an RDN commonName value consisting of 5 Finally, an example of an RDN commonName value consisting of 5
letters: letters:
Unicode Letter Description UCS code UTF-8 Escaped Unicode Character Code UTF-8 Escaped
------------------------------- -------- ------ -------- ------------------------------- ------ ------ --------
LATIN CAPITAL LETTER L U+004C 0x4C L LATIN CAPITAL LETTER L U+004C 0x4C L
LATIN SMALL LETTER U U+0075 0x75 u LATIN SMALL LETTER U U+0075 0x75 u
LATIN SMALL LETTER C WITH CARON U+010D 0xC48D \C4\8D LATIN SMALL LETTER C WITH CARON U+010D 0xC48D \C4\8D
LATIN SMALL LETTER I U+0069 0x69 i LATIN SMALL LETTER I U+0069 0x69 i
LATIN SMALL LETTER C WITH ACUTE U+0107 0xC487 \C4\87 LATIN SMALL LETTER C WITH ACUTE U+0107 0xC487 \C4\87
could be written in printable ASCII (useful for debugging purposes): could be written in printable ASCII (useful for debugging purposes):
CN=Lu\C4\8Di\C4\87 CN=Lu\C4\8Di\C4\87
skipping to change at page 9, line 21 skipping to change at page 9, line 20
The transformations of an AttributeValue value from its X.501 form to The transformations of an AttributeValue value from its X.501 form to
an LDAP string representation are not always reversible back to the an LDAP string representation are not always reversible back to the
same BER (Basic Encoding Rules) or DER (Distinguished Encoding rules) same BER (Basic Encoding Rules) or DER (Distinguished Encoding rules)
form. An example of a situation which requires the DER form of a form. An example of a situation which requires the DER form of a
distinguished name is the verification of an X.509 certificate. distinguished name is the verification of an X.509 certificate.
For example, a distinguished name consisting of one RDN with one AVA, For example, a distinguished name consisting of one RDN with one AVA,
in which the type is commonName and the value is of the TeletexString in which the type is commonName and the value is of the TeletexString
choice with the letters 'Sam' would be represented in LDAP as the choice with the letters 'Sam' would be represented in LDAP as the
string CN=Sam. Another distinguished name in which the value is still string <CN=Sam>. Another distinguished name in which the value is
'Sam' but of the PrintableString choice would have the same still 'Sam' but of the PrintableString choice would have the same
representation CN=Sam. representation <CN=Sam>.
Applications which require the reconstruction of the DER form of the Applications which require the reconstruction of the DER form of the
value SHOULD NOT use the string representation of attribute syntaxes value SHOULD NOT use the string representation of attribute syntaxes
when converting a distinguished name to the LDAP format. Instead, when converting a distinguished name to the LDAP format. Instead,
they SHOULD use the hexadecimal form prefixed by the number sign ('#') they SHOULD use the hexadecimal form prefixed by the number sign ('#')
as described in the first paragraph of Section 2.3. as described in the first paragraph of Section 2.3.
6. Acknowledgment 6. Acknowledgment
This document is an update to RFC 2253, by Mark Wahl, Tim Howes, and This document is an update to RFC 2253, by Mark Wahl, Tim Howes, and
skipping to change at page 10, line 17 skipping to change at page 10, line 16
Telecommunication Standardization Sector, "Abstract Telecommunication Standardization Sector, "Abstract
Syntax Notation One (ASN.1) - Specification of Basic Syntax Notation One (ASN.1) - Specification of Basic
Notation", X.680(1997) (also ISO/IEC 8824-1:1998). Notation", X.680(1997) (also ISO/IEC 8824-1:1998).
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14 (also RFC 2119), March 1997. Requirement Levels", BCP 14 (also RFC 2119), March 1997.
[RFC2234] Crocker, D. and P. Overell, "Augmented BNF for Syntax [RFC2234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", RFC 2234, November 1997. Specifications: ABNF", RFC 2234, November 1997.
[UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO [RFC3329] Yergeau, F., "UTF-8, a transformation format of ISO
10646", draft-yergeau-rfc2279bis-xx.txt, a work in 10646", RFC 3329 (also STD 64), November 2003.
progress.
[Unicode] The Unicode Consortium, "The Unicode Standard, Version
3.2.0" is defined by "The Unicode Standard, Version 3.0"
(Reading, MA, Addison-Wesley, 2000. ISBN 0-201-61633-5),
as amended by the "Unicode Standard Annex #27: Unicode
3.1" (http://www.unicode.org/reports/tr27/) and by the
"Unicode Standard Annex #28: Unicode 3.2"
(http://www.unicode.org/reports/tr28/).
[Models] Zeilenga, K. (editor), "LDAP: Directory Information [Models] Zeilenga, K. (editor), "LDAP: Directory Information
Models", draft-ietf-ldapbis-models-xx.txt, a work in Models", draft-ietf-ldapbis-models-xx.txt, a work in
progress. progress.
[Roadmap] Zeilenga, K. (editor), "LDAP: Technical Specification [Roadmap] Zeilenga, K. (editor), "LDAP: Technical Specification
Road Map", draft-ietf-ldapbis-roadmap-xx.txt, a work in Road Map", draft-ietf-ldapbis-roadmap-xx.txt, a work in
progress. progress.
[Protocol] Sermersheim, J. (editor), "LDAP: The Protocol", [Protocol] Sermersheim, J. (editor), "LDAP: The Protocol",
draft-ietf-ldapbis-protocol-xx.txt, a work in progress. draft-ietf-ldapbis-protocol-xx.txt, a work in progress.
[Syntaxes] Legg, S. (editor), "LDAP: Syntaxes and Matching Rules", [Syntaxes] Legg, S. (editor), "LDAP: Syntaxes and Matching Rules",
draft-ietf-ldapbis-syntaxes-xx.txt, a work in progress. draft-ietf-ldapbis-syntaxes-xx.txt, a work in progress.
[Schema] Dally, K. (editor), "LDAP: User Schema", [Schema] Dally, K. (editor), "LDAP: User Schema",
draft-ietf-ldapbis-user-schema-xx.txt, a work in draft-ietf-ldapbis-user-schema-xx.txt, a work in
progress. progress.
[ISO10646] International Organization for Standardization,
"Universal Multiple-Octet Coded Character Set (UCS) -
Architecture and Basic Multilingual Plane", ISO/IEC
10646-1 : 1993.
[REGISTRY] IANA, Object Identifier Descriptors Registry, [REGISTRY] IANA, Object Identifier Descriptors Registry,
<http://www.iana.org/...>. <http://www.iana.org/...>.
9. Informative References 9. Informative References
[ASCII] Coded Character Set--7-bit American Standard Code for [ASCII] Coded Character Set--7-bit American Standard Code for
Information Interchange, ANSI X3.4-1986. Information Interchange, ANSI X3.4-1986.
[X.500] International Telecommunication Union - [X.500] International Telecommunication Union -
Telecommunication Standardization Sector, "The Directory Telecommunication Standardization Sector, "The Directory
skipping to change at page 11, line 23 skipping to change at page 11, line 23
Canonical Encoding Rules (CER), and Distinguished Canonical Encoding Rules (CER), and Distinguished
Encoding Rules (DER)", X.690(1997) (also ISO/IEC Encoding Rules (DER)", X.690(1997) (also ISO/IEC
8825-1:1998). 8825-1:1998).
[RFC2849] Good, G., "The LDAP Data Interchange Format (LDIF) - [RFC2849] Good, G., "The LDAP Data Interchange Format (LDIF) -
Technical Specification", RFC 2849, June 2000. Technical Specification", RFC 2849, June 2000.
[BCP64bis] Zeilenga, K., "IANA Considerations for LDAP", draft- [BCP64bis] Zeilenga, K., "IANA Considerations for LDAP", draft-
ietf-ldapbis-bcp64-xx.txt, a work in progress. ietf-ldapbis-bcp64-xx.txt, a work in progress.
[CharModel] Whistler, K. and M. Davis, "Unicode Technical Report
#17, Character Encoding Model", UTR17,
<http://www.unicode.org/unicode/reports/tr17/>, August
2000.
[Glossary] The Unicode Consortium, "Unicode Glossary",
<http://www.unicode.org/glossary/>.
Appendix A. Presentation Issues Appendix A. Presentation Issues
This appendix is provided for informational purposes only, it is not a This appendix is provided for informational purposes only, it is not a
normative part of this specification. normative part of this specification.
The string representation described in this document is not intended The string representation described in this document is not intended
to be presented to humans without translation. However, at times it to be presented to humans without translation. However, at times it
may be desirable to present non-translated DN strings to users. This may be desirable to present non-translated DN strings to users. This
section discusses presentation issues associated with non-translated section discusses presentation issues associated with non-translated
DN strings. Presentation of translated DN strings issues are not DN strings. Presentation of translated DN strings issues are not
discussed in this appendix. Transcoding issues are also not discussed discussed in this appendix. Transcoding issues are also not discussed
in this appendix. in this appendix.
This appendix provides guidance for applications presenting DN strings This appendix provides guidance for applications presenting DN strings
to users. This section is not comprehensive, it does not discuss all to users. This section is not comprehensive, it does not discuss all
presentation issues which implementors may face. presentation issues which implementors may face.
Not all user interfaces are capable of displaying the full set of UCS Not all user interfaces are capable of displaying the full set of
characters. Some UCS characters are not displayable. Unicode characters. Some Unicode characters are not displayable.
It is recommended that human interfaces use the optional hex pair It is recommended that human interfaces use the optional hex pair
escaping mechanism (Section 2.3) to produce a string representation escaping mechanism (Section 2.3) to produce a string representation
suitable for display to the user. For example, an application can suitable for display to the user. For example, an application can
generate a DN string for display which escapes all non-printable generate a DN string for display which escapes all non-printable
characters appearing in the AttributeValue's string representation (as characters appearing in the AttributeValue's string representation (as
demonstrated in the final example of Section 4). demonstrated in the final example of Section 4).
When a DN string is displayed in free form text, it is often necessary When a DN string is displayed in free form text, it is often necessary
to distinguish the DN string from surrounding text. While this is to distinguish the DN string from surrounding text. While this is
often done with white space (as demonstrated in Section 4), it is often done with white space (as demonstrated in Section 4), it is
noted that DN strings may end with white space. Careful readers of noted that DN strings may end with white space. Careful readers of
Section 3 will note that characters "<" (U+003C) and ">" (U+003E) may Section 3 will note that characters '<' (U+003C) and '>' (U+003E) may
only appear in the DN string if escaped. These characters are only appear in the DN string if escaped. These characters are
intended to be used in free form text to distinguish a DN string from intended to be used in free form text to distinguish a DN string from
surrounding text. For example, <CN=Sam\ > distinguished the string surrounding text. For example, <CN=Sam\ > distinguished the string
representation of the DN comprised of one RDN consisting of the AVA: representation of the DN comprised of one RDN consisting of the AVA:
the commonName (CN) value "Sam " from the surrounding text. It should the commonName (CN) value 'Sam ' from the surrounding text. It should
be noted to the user that the wrapping "<" and ">" characters are not be noted to the user that the wrapping '<' and '>' characters are not
part of the DN string. part of the DN string.
DN strings can be quite long. It is often desirable to line-wrap DN strings can be quite long. It is often desirable to line-wrap
overly long DN strings in presentations. Line wrapping should be done overly long DN strings in presentations. Line wrapping should be done
by inserting white space after the RDN separator character or, if by inserting white space after the RDN separator character or, if
necessary, after the AVA separator character. It should be noted to necessary, after the AVA separator character. It should be noted to
the user that the inserted white space is not part of the DN string the user that the inserted white space is not part of the DN string
and is to be removed before use in LDAP. For example, and is to be removed before use in LDAP. For example,
The following DN string is long: The following DN string is long:
skipping to change at page 12, line 50 skipping to change at page 13, line 12
SN: Zeilenga SN: Zeilenga
objectClass: person objectClass: person
Appendix B. Changes made since RFC 2253 Appendix B. Changes made since RFC 2253
This appendix is provided for informational purposes only, it is not a This appendix is provided for informational purposes only, it is not a
normative part of this specification. normative part of this specification.
The following substantive changes were made to RFC 2253: The following substantive changes were made to RFC 2253:
- Removed IESG Note. The IESG Note has been addressed. - Removed IESG Note. The IESG Note has been addressed.
- Replaced all references to ISO 10646-1 with [Unicode].
- Clarified (in Section 1) that this document does not define a - Clarified (in Section 1) that this document does not define a
canonical string representation. canonical string representation.
- Revised specification (in Section 2) to allow short names of any - Revised specification (in Section 2) to allow short names of any
registered attribute type to appear in string representations of registered attribute type to appear in string representations of
DNs instead of being restricted to a "published table". Remove DNs instead of being restricted to a "published table". Remove
"as an example" language. Added statement (in Section 3) allowing "as an example" language. Added statement (in Section 3) allowing
recognition of additional names but require recognization of those recognition of additional names but require recognization of those
names in the published table. The table is now published in names in the published table. The table is now published in
Section 3. Section 3.
- Replaced specification of additional requirements for LDAPv2 - Replaced specification of additional requirements for LDAPv2
implementations which also support LDAPv3 (RFC 2253, Section 4) implementations which also support LDAPv3 (RFC 2253, Section 4)
with a statement (in Section 3) allowing recognition of with a statement (in Section 3) allowing recognition of
alternative string representations. alternative string representations.
- Updated Section 2.3 to indicate attribute type name strings are - Updated Section 2.3 to indicate attribute type name strings are
case insensitive. case insensitive.
- Updated Section 2.4 to allow hex pair escaping of all characters - Updated Section 2.4 to allow hex pair escaping of all characters
and clarified escaping for when multiple octet UTF-8 characters and clarified escaping for when multiple octet UTF-8 echodings are
are present. present.
- Rewrote Section 3 to use ABNF as defined in RFC 2234. - Rewrote Section 3 to use ABNF as defined in RFC 2234.
- Rewrote Section 3 ABNF to be consistent with 2.4. - Rewrote Section 3 ABNF to be consistent with 2.4.
- Updated Section 3 to describe how to parse elements of the - Updated Section 3 to describe how to parse elements of the
grammar. grammar.
- Rewrote examples. - Rewrote examples.
- Added reference to documentations containing general LDAP security - Added reference to documentations containing general LDAP security
considerations. considerations.
- Added discussion of presentation issues (Appendix A). - Added discussion of presentation issues (Appendix A).
- Added this appendix. - Added this appendix.
skipping to change at page 14, line 10 skipping to change at page 14, line 19
from the IETF Secretariat. from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive this standard. Please address the information to the IETF Executive
Director. Director.
Full Copyright Full Copyright
Copyright (C) The Internet Society (2003). All Rights Reserved. Copyright (C) The Internet Society (2004). All Rights Reserved.
This document and translations of it may be copied and furnished to This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it others, and derivative works that comment on or otherwise explain it
or assist in its implmentation may be prepared, copied, published and or assist in its implementation may be prepared, copied, published and
distributed, in whole or in part, without restriction of any kind, distributed, in whole or in part, without restriction of any kind,
provided that the above copyright notice and this paragraph are provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be followed, copyrights defined in the Internet Standards process must be followed,
or as required to translate it into languages other than English. or as required to translate it into languages other than English.
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/