Ability to define and create an LDAP Distinguished Name (DN).



Try This:

Using the data hierarchy you wrote down in this previous section, construct a DN for yourself similar to the ones shown here.













See Chapter 1 of the Deployment Guide.






















Never escape internal quotation marks when using LDIF.

 

Distinguished Names

 
Distinguished names (DNs) are the string representations for entry names in a Directory Server directory.  You use DNs to name entries using the LDAP Data Interchange Format (LDIF), when using the LDAP clients, when configuring the Directory Server, and so forth.  Traditionally, DNs consist of the following items in this order:
  • A common name.
  • A list of regional or organizational attributes.
  • A country designation.
This string of identifying attributes uniquely locates the entry within your Directory Server directory. If you choose, you can also use this naming structure to uniquely identify your entries within the global directory tree as defined in the X.500 standard.

Distinguished Name Syntax

The traditional syntax for a DN string representation is as follows:
    cn=common name, [street=address, l=locality, st=state or province, 
    ou=organizational unit, o=organization], c=country name
A DN can consist of virtually any attributes you want to use. The only caveat is that if schema checking is turned on, then the attributes must be recognized by the Directory Server, and must be allowed by the entry's object classes. 

Generally, however, a DN begins with a specific common name and proceeds with increasingly broader areas of identification until the country name is specified. Note, however, that the DN attributes you use, and the order in which you organize them, is up to you. The only requirement is that DN attributes must be separated by a comma (,) and can optionally use a space ( ) following the separator. 

Once you have organized your directory structure, then the DN attributes must always be specified in the same order because a DN represents a path through the directory tree. For example, the following DNs do not represent the same entry:

    cn=Ralph Swenson, ou=Accounting, o=Ace Industry, c=US 
    cn=Ralph Swenson, o=Ace Industry, ou=Accounting, c=US
Also, distinguished names representing branch points in the directory will not begin with a common name value. Rather, they will begin with some sub-element in the directory path. For example, if your directory contained entries of the form:
          cn=name, ou=Marketing, o=Ace Industry, c=US
then your directory would also contain the entries:
          o=Ace Industry, c=US
          ou=Marketing, o=Ace Industry, c=US
These two entries must appear in the directory before the entries represented by a common name can appear. 

Distinguished Name Attributes

The various standard attributes that comprise a DN are as follows:
 
Attribute Name Definition
country  Identifies the name of the country under which the entry resides. Must be the two-letter country code. For example: c=US c=GB
cn  common name  Required attribute that identifies the person or object defined by the entry. For example: cn=Wally Henderson cn=Database Administrators cn=printer3b
locality  Identifies the locality in which the entry resides. The locality could be a city, county, township, or other geographic region. For example: l=Tucson l=Pacific Northwest l=Anoka County
organization  Identifies the organization in which the entry resides. For example: o=Netscape Communications Corp o=Public Power & Gas
ou  organizational unit  Identifies a unit within the organization. For example: ou=Sales ou=Manufacturing
st  state or province name  Identifies the state or province in which the entry resides. For example: st=Iowa st=British Columbia
street street address  Identifies the street address at which the entry resides. For example: street=494 Rice Creek Terrace

Using Commas in Distinguished Names

If you want to use a comma (,) in your distinguished names, then the part of the name that uses the comma must also be quoted (` `). For example, to use the string Ace Industry, Corp in your distinguished name, you would quote it as follows:
          o='Ace Industry, Corp', c=US
If you are using a distinguished name that uses commas in slapd.conf, and you need to enclose the entire distinguished name in quotation marks, then you must escape (\) the internal quotation marks. For example:
          `o=\'Ace Industry, Corp\', c=US'
You are required to escape the internal quotation marks only when you are using slapd.conf; when you are using LDIF, you should never have to quote entire distinguished names.

Distinguished Name Examples

The following are some traditional examples of distinguished names:
    cn=Wally Henderson,ou=Product Development,o=Bait and Tackle Inc, 
    st=Minnesota,c=US
    cn=Retch Sweeny, ou=Product Test, o=Bait and Tackle Inc, st=Michigan, 
    c=US
    cn=printer3b, l=room 308, o=Acme Programming Ltd, c=US
Another example of a distinguished name using a non-traditional format might be:
uid=bjensen, ou=people, o=airius.com
Distinguished names in an LDAP directory are not required to follow X.500 standard naming conventions. LDAP allows you to structure your distinguished name in a hierarchy that can be more easily managed. 

In the above example, the root of the directory tree is identified by the organization attribute (o) and not the country attribute (c). In the example, the value of the organization attribute is set to the DNS name for the company (airius.com). The advantage of this format is that most companies have a unique DNS name and many are multi-national, therefore, the root of their directory tree is not restricted to a country designator. 

Also in the above example, all employees are placed in the organizational unit (ou) people instead of real organizational units. The advantage of this format is the reduced administration each time the company reorganizes or an employee moves to a different organization (the tree structure remains the same).

The last change in the example above is that a person's distinguished name in the directory tree is identified by their user identification attribute (uid) instead of their common name attribute (cn). Using a unique uid for each person eliminates the possibility of having duplicate common names in the directory.

Copyright © 2000
Sun-Netscape Alliance