Skip to main content

2. Converting DistinguishedName from ASN.1 to a String

X.501 [X.501] defines the ASN.1 [X.680] structure of distinguished name. The following is a variant provided for discussion purposes.

  DistinguishedName ::= RDNSequence

  RDNSequence ::= SEQUENCE OF RelativeDistinguishedName

  RelativeDistinguishedName ::= SET SIZE (1..MAX) OF
      AttributeTypeAndValue

  AttributeTypeAndValue ::= SEQUENCE {
      type  AttributeType,
      value AttributeValue }

This section defines the RECOMMENDED algorithm for converting a distinguished name from an ASN.1-structured representation to a UTF-8 [RFC3629] encoded Unicode [Unicode] character string representation. Other documents may describe other algorithms for converting a distinguished name to a string, but only strings that conform to the grammar defined in Section 3 SHALL be produced by LDAP implementations.

2.1. Converting the RDNSequence​

If the RDNSequence is an empty sequence, the result is the empty or zero-length string.

Otherwise, the output consists of the string encodings of each RelativeDistinguishedName in the RDNSequence (according to Section 2.2), starting with the last element of the sequence and moving backwards toward the first.

The encodings of adjoining RelativeDistinguishedNames are separated by a comma (',' U+002C) character.

2.2. Converting RelativeDistinguishedName​

When converting from an ASN.1 RelativeDistinguishedName to a string, the output consists of the string encodings of each AttributeTypeAndValue (according to Section 2.3), in any order.

Where there is a multi-valued RDN, the outputs from adjoining AttributeTypeAndValues are separated by a plus sign ('+' U+002B) character.

2.3. Converting AttributeTypeAndValue​

The AttributeTypeAndValue is encoded as the string representation of the AttributeType, followed by an equals sign ('=' U+003D) character, followed by the string representation of the AttributeValue. The encoding of the AttributeValue is given in Section 2.4.

If the AttributeType is defined to have a short name (descriptor) [RFC4512] and that short name is known to be registered [REGISTRY] [RFC4520] as identifying the AttributeType, that short name, a , is used. Otherwise the AttributeType is encoded as the dotted-decimal encoding, a , of its OBJECT IDENTIFIER. The and are defined in [RFC4512].

Implementations are not expected to dynamically update their knowledge of registered short names. However, implementations SHOULD provide a mechanism to allow their knowledge of registered short names to be updated.

2.4. Converting an AttributeValue from ASN.1 to a String​

If the AttributeType is of the dotted-decimal form, the AttributeValue is represented by an number sign ('#' U+0023) character followed by the hexadecimal encoding of each of the octets of the BER encoding of the X.500 AttributeValue. This form is also used when the syntax of the AttributeValue does not have an LDAP- specific ([RFC4517], Section 3.1) string encoding defined for it, or the LDAP-specific string encoding is not restricted to UTF-8-encoded Unicode characters. This form may also be used in other cases, such as when a reversible string representation is desired (see Section 5.2).

Otherwise, if the AttributeValue is of a syntax that has a LDAP- specific string encoding, the value is converted first to a UTF-8- encoded Unicode string according to its syntax specification (see [RFC4517], Section 3.3, for examples). If that UTF-8-encoded Unicode string does not have any of the following characters that need escaping, then that string can be used as the string representation of the value.

  - a space (' ' U+0020) or number sign ('#' U+0023) occurring at
    the beginning of the string;

  - a space (' ' U+0020) character occurring at the end of the
    string;

  - one of the characters '"', '+', ',', ';', '<', '>',  or '\'
    (U+0022, U+002B, U+002C, U+003B, U+003C, U+003E, or U+005C,
    respectively);

  - the null (U+0000) character.

Other characters may be escaped.

Each octet of the character to be escaped is replaced by a backslash and two hex digits, which form a single octet in the code of the character. Alternatively, if and only if the character to be escaped is one of

  ' ', '"', '#', '+', ',', ';', '<', '=', '>', or '\'
  (U+0020, U+0022, U+0023, U+002B, U+002C, U+003B,
   U+003C, U+003D, U+003E, U+005C, respectively)

it can be prefixed by a backslash ('' U+005C).

Examples of the escaping mechanism are shown in Section 4.