Skip to main content

3. Parsing a String Back to a Distinguished Name

The string representation of Distinguished Names is restricted to UTF-8 [RFC3629] encoded Unicode [Unicode] characters. The structure of this string representation is specified using the following Augmented BNF [RFC4234] grammar:

  distinguishedName = [ relativeDistinguishedName
      *( COMMA relativeDistinguishedName ) ]
  relativeDistinguishedName = attributeTypeAndValue
      *( PLUS attributeTypeAndValue )
  attributeTypeAndValue = attributeType EQUALS attributeValue
  attributeType = descr / numericoid
  attributeValue = string / hexstring

  ; The following characters are to be escaped when they appear
  ; in the value to be encoded: ESC, one of <escaped>, leading
  ; SHARP or SPACE, trailing SPACE, and NULL.
  string =   [ ( leadchar / pair ) [ *( stringchar / pair )
     ( trailchar / pair ) ] ]

  leadchar = LUTF1 / UTFMB
  LUTF1 = %x01-1F / %x21 / %x24-2A / %x2D-3A /
     %x3D / %x3F-5B / %x5D-7F

  trailchar  = TUTF1 / UTFMB
  TUTF1 = %x01-1F / %x21 / %x23-2A / %x2D-3A /

     %x3D / %x3F-5B / %x5D-7F

  stringchar = SUTF1 / UTFMB
  SUTF1 = %x01-21 / %x23-2A / %x2D-3A /
     %x3D / %x3F-5B / %x5D-7F

  pair = ESC ( ESC / special / hexpair )
  special = escaped / SPACE / SHARP / EQUALS
  escaped = DQUOTE / PLUS / COMMA / SEMI / LANGLE / RANGLE
  hexstring = SHARP 1*hexpair
  hexpair = HEX HEX

where the productions , , , , , , , , , , , , , , and are defined in [RFC4512].

Each , either a or a , refers to an attribute type of an attribute value assertion (AVA). The is followed by an and an . The is either in or form.

If in form, a LDAP string representation asserted value can be obtained by replacing (left to right, non-recursively) each appearing in the as follows:

  replace <ESC><ESC> with <ESC>;
  replace <ESC><special> with <special>;
  replace <ESC><hexpair> with the octet indicated by the <hexpair>.

If in form, a BER representation can be obtained from converting each of the to the octet indicated by the .

There is one or more attribute value assertions, separated by , for a relative distinguished name.

There is zero or more relative distinguished names, separated by , for a distinguished name.

Implementations MUST recognize AttributeType name strings (descriptors) listed in the following table, but MAY recognize other name strings.

  String  X.500 AttributeType
  ------  --------------------------------------------
  CN      commonName (2.5.4.3)
  L       localityName (2.5.4.7)
  ST      stateOrProvinceName (2.5.4.8)
  O       organizationName (2.5.4.10)
  OU      organizationalUnitName (2.5.4.11)
  C       countryName (2.5.4.6)
  STREET  streetAddress (2.5.4.9)
  DC      domainComponent (0.9.2342.19200300.100.1.25)
  UID     userId (0.9.2342.19200300.100.1.1)

These attribute types are described in [RFC4519].

Implementations MAY recognize other DN string representations. However, as there is no requirement that alternative DN string representations be recognized (and, if so, how), implementations SHOULD only generate DN strings in accordance with Section 2 of this document.