Distinguished names (DNs) are the string representation for entry names in a Directory Server directory. You use DNs to name entries using the LDAP Data Interchange Format (LDIF), when using the LDAP clients, when configuring the Directory Server, and so forth. 

 

Distinguished Names

DN Components 
A DN consists of the following components in this order: 
    • A common name 
    • A list of regional or organizational attributes. 
    • A country designation. 


    This string of identifying attributes uniquely locates the entry within your Directory Server directory. If you choose, you can also use this naming structure to uniquely identify your entries within the global directory tree as defined in the X.500 standard. 


Distinguished Name Syntax

The traditional syntax for a DN string representation is as follows: 

cn=common name, [street=address, l=locality, st=state or province, 
ou=organizational unit, o=organization], c=country name

A DN can consist of virtually any attributes you want to use. The only caveat is that if schema checking is turned on, then the attributes must be recognized by the Directory Server, and must be allowed by the entry's object classes. 

Generally, however, a DN begins with a specific common name and proceeds with increasingly broader areas of identification until the country name is specified. Note, however, that the DN attributes you use, and the order in which you organize them, is up to you.  The only requirement is that DN attributes must be separated by a comma (,) and can optionally use a space ( ) following the separator. 

Once you have organized your directory structure, then the DN attributes must always be specified in the same order because a DN represents a path through the directory tree. For example, the following DNs do not represent the same entry: 

cn=Ralph Swenson, ou=Accounting, o=Ace Industry, c=US 
cn=Ralph Swenson, o=Ace Industry, ou=Accounting, c=US

Also, distinguished names representing branch points in the directory will not begin with a common name value. Rather, they will begin with some subelement in the directory path. For example, if your directory contained entries of the form:

cn=name, ou=Marketing, o=Ace Industry, c=US

then your directory would also contain the entries:

o=Ace Industry, c=US
ou=Marketing, o=Ace Industry, c=US

These two entries must appear in the directory before the entries represented by a common name can appear. 
 

Distinguished Name Examples
The following are some traditional examples of distinguished names: 
    cn=Wally Henderson,ou=Product Development,o=Bait and Tackle Inc, st=Minnesota,c=US
    cn=Retch Sweeny, ou=Product Test, o=Bait and Tackle Inc, st=Michigan, c=US
    cn=printer3b, l=room 308, o=Acme Programming Ltd, c=US

    Another example of a distinguished name using a non-traditional format might be: 
     

      uid=bjensen, ou=people, o=airius.com


    Distinguished names in an LDAP directory are not required to follow X.500 standard naming conventions. LDAP allows you to structure your distinguished name in a hierarchy that can be more easily managed. 

    In the above example, the root of the directory tree is identified by the organization attribute (o) and not the country attribute (c). In the example, the value of the organization attribute is set to the DNS name for the company (airius.com). The advantage of this format is that most companies have a unique DNS name and many are multi-national, therefore, the root of their directory tree is not restricted to a country designator. 

     Also in the above example, all employees are placed in the organizational unit (ou) people instead of real organizational units. The advantage of this format is the reduced administration each time the company reorganizes or an employee moves to a different organization (the tree structure remains the same). 

    The last change in the example above is that a person's distinguished name in the directory tree is identified by their user identification attribute (uid) instead of their common name attribute (cn). Using a unique uid for each person eliminates the possibility of having duplicate common names in the directory. 


Produced By Netscape Learning.  Copyright © 1998 Netscape Communications, Inc.