Ability to define and create
an LDAP Distinguished Name (DN). |
Try This:
Using the data hierarchy
you wrote down in this previous section, construct a DN for yourself similar
to the ones shown here. |
Never escape internal quotation
marks when using LDIF.
|
|
Distinguished Names
Distinguished names (DNs) are the string representations for entry
names in a Directory Server directory. You use DNs to name
entries using the LDAP Data Interchange Format (LDIF),
when using the LDAP
clients, when configuring the Directory Server, and so forth.
Traditionally, DNs consist of the following items in this order:
-
A common name.
-
A list of regional or organizational attributes.
-
A country designation.
This string of identifying attributes uniquely locates the entry within
your Directory Server directory. If you choose, you can also use this naming
structure to uniquely identify your entries within the global directory
tree as defined in the X.500
standard.
Distinguished Name Syntax
The traditional syntax for a DN string representation is as
follows:
cn=common name, [street=address, l=locality, st=state or province,
ou=organizational unit, o=organization], c=country name
A DN can consist of virtually any attributes you want to use. The only
caveat is that if schema checking is turned on, then the attributes must
be recognized by the Directory Server, and must be allowed by the entry's
object classes.
Generally, however, a DN begins with a specific common name and proceeds
with increasingly broader areas of identification until the country name
is specified. Note, however, that the DN attributes you use, and the order
in which you organize them, is up to you. The only requirement is that
DN attributes must be separated by a comma (,) and can optionally use a
space ( ) following the separator.
Once you have organized your directory structure, then the DN attributes
must always be specified in the same order because a DN represents a path
through the directory tree. For example, the following DNs do not represent
the same entry:
cn=Ralph Swenson, ou=Accounting, o=Ace Industry, c=US
cn=Ralph Swenson, o=Ace Industry, ou=Accounting, c=US
Also, distinguished names representing branch points in the directory will
not begin with a common name value. Rather, they will begin with some sub-element
in the directory path. For example, if your directory contained entries
of the form:
cn=name, ou=Marketing, o=Ace Industry, c=US
then your directory would also contain the entries:
o=Ace Industry, c=US
ou=Marketing, o=Ace Industry, c=US
These two entries must appear in the directory before the entries
represented by a common name can appear.
Distinguished Name Attributes
The various standard attributes that comprise a DN are as follows:
Attribute |
Name |
Definition |
c |
country |
Identifies the name of the country under which the entry resides. Must
be the two-letter country code. For example: c=US c=GB |
cn |
common name |
Required attribute that identifies the person or object defined by
the entry. For example: cn=Wally Henderson cn=Database Administrators
cn=printer3b |
l |
locality |
Identifies the locality in which the entry resides. The locality could
be a city, county, township, or other geographic region. For example: l=Tucson
l=Pacific Northwest l=Anoka County |
o |
organization |
Identifies the organization in which the entry resides. For example:
o=Netscape
Communications Corp o=Public Power & Gas |
ou |
organizational unit |
Identifies a unit within the organization. For example: ou=Sales
ou=Manufacturing |
st |
state or province name |
Identifies the state or province in which the entry resides. For example:
st=Iowa
st=British Columbia |
street |
street address |
Identifies the street address at which the entry resides. For example:
street=494
Rice Creek Terrace |
Using Commas in Distinguished Names
If you want to use a comma (,) in your distinguished names,
then the part of the name that uses the comma must also be quoted (`
`). For example, to use the string Ace Industry, Corp in your distinguished
name, you would quote it as follows:
o='Ace Industry, Corp', c=US
If you are using a distinguished name that uses commas in slapd.conf,
and you need to enclose the entire distinguished name in quotation marks,
then you must escape (\) the internal quotation marks. For example:
`o=\'Ace Industry, Corp\', c=US'
You are required to escape the internal quotation marks only
when you are using slapd.conf;
when you are using LDIF,
you should never have to quote entire distinguished names.
Distinguished Name Examples
The following are some traditional examples of distinguished
names:
cn=Wally Henderson,ou=Product Development,o=Bait and Tackle Inc,
st=Minnesota,c=US
cn=Retch Sweeny, ou=Product Test, o=Bait and Tackle Inc, st=Michigan,
c=US
cn=printer3b, l=room 308, o=Acme Programming Ltd, c=US
Another example of a distinguished name using a non-traditional format
might be:
uid=bjensen, ou=people, o=airius.com
Distinguished names in an LDAP directory are not required to follow X.500
standard naming conventions. LDAP allows you to structure your distinguished
name in a hierarchy that can be more easily managed.
In the above example, the root of the directory tree is identified by
the organization attribute (o) and not the country attribute (c). In the
example, the value of the organization attribute is set to the DNS
name for the company (airius.com). The advantage of this format is that
most companies have a unique DNS name and many are multi-national, therefore,
the root of their directory tree is not restricted to a country designator.
Also in the above example, all employees are placed in the organizational
unit (ou) people instead of real organizational units. The advantage of
this format is the reduced administration each time the company reorganizes
or an employee moves to a different organization (the tree structure remains
the same).
The last change in the example above is that a person's distinguished
name in the directory tree is identified by their user identification attribute
(uid) instead
of their common name attribute (cn). Using a unique uid for each person
eliminates the possibility of having duplicate common names in the directory.
|