mail us  |  mail this page

products  |  company  |  support  |  training  |  contact us

ZYTRAX OPEN LOGO

Appendix A - LDAP: DN & RDN

The DN (Distinguished Name) must be unique (or unique'ish see below) in the (DIT). The DN describes the contents of attributes in the tree (the navigation path) that will reach the specific entry required OR the search start entry.

A DN is comprised of a series of RDNs (Relative Distinguished Names) found by walking UP the tree (DIT) to its root (or suffix or base) and is written LEFT to RIGHT unlike the file system analogy you see quoted everywhere which is written RIGHT to LEFT. If you are into analogies it's like more like a fully qualified domain name (FQDN). If you don't know what a fully qualified domain name is - forget analogies!

The DN is written LEFT to RIGHT.

Before we move on its worth taking a few minutes to figure out what we are trying to do when we access the DIT and what the term unique may mean.

  1. If we are searching then the term unique may not be what we want - we may only want a unique'ish DN.

  2. If we are writing (modifying) then the DN must be unique - we only want to write to one record.

The DN is composed of a series of RDNs (Relative Distinguished Names) which are the unique (or unique'ish) attributes at each level in the DIT hierarchy.

The following diagram illustrates building up the DN from the RDN's:

DNs and RDNs - Tree Hierarchy

In the above example we have selected the cn (commonName) attribute as our RDN because it is unique at this level in the directory. This gives a full DN of:

DN: cn=Robert Smith,ou=people,dc=example,dc=com

BUT we could have selected the uid (userID) attribute as our RDN because it is also unique (see below). Both result in perfectly valid DNs.

There is nothing magical about the attribute you select as an RDN - other than it is unique (for writing) and must always be unique - when the second Robert Smith comes to work for the organization will cn still be unique? If it is not unique then it is still OK for searching (reading) but useless for writing - in which case some other attribute or combination of attributes must be used.

Note: When an entry is added (or created) it is always assigned a DN and, in general, this DN is usually that which is most frequently used to access the entry. However, if this entry will be used for authentication purposes then special considerations apply.

DNs and RDNs - Tree Hierarchy

Finally, it is possible to combine two or more attributes to form a multi-valued RDN which is then used in the DN. In the above example it would be possible to create a RDN combining cn+uid to create the following DN:

DN: cn=Robert Smith+uid=rsmith,ou=people,dc=example,dc=com

Note: Typically if you search on an attribute frequently it should be indexed.



Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.

Copyright © 1994 - 2014 ZyTrax, Inc.
All rights reserved. Legal and Privacy
site by zytrax
Hosted by super.net.sg
web-master at zytrax
Page modified: December 13 2013.

Contents

tech info
guides home
intro
contents
1 objectives
big picture
2 concepts
3 ldap objects
quickstart
4 install ldap
5 samples
6 configuration
7 replica & refer
reference
8 ldif
9 protocol
10 ldap api
operations
11 howtos
12 trouble
13 performance
14 ldap tools
security
15 security
appendices
notes & info
ldap resources
rfc's & x.500
glossary
ldap objects
change log

Creative Commons License
This work is licensed under a Creative Commons License.

If you are happy it's OK - but your browser is giving a less than optimal experience on our site. You could, at no charge, upgrade to a W3C STANDARDS COMPLIANT browser such as Firefox

web zytrax.com

Share Page

share page via facebook tweet this page submit page to stumbleupon submit page to reddit.com

Page Features

Page comment feature Send to a friend feature print this page Decrease font size Increase font size

RSS Feed Icon RSS Feed

Resources

Systems

FreeBSD
NetBSD
OpenBSD
DragonFlyBSD
Linux.org
Debian Linux

Applications

LibreOffice
OpenOffice
Mozilla
SourceForge
GNU-Free SW Foundation

Organisations

Open Source Initiative
Creative Commons

Misc.

Ibiblio - Library
Open Book Project
Open Directory
Wikipedia

SPF Resources

Draft RFC
SPF Web Site
SPF Testing
SPF Testing (member only)

Display full width page Full width page

Print this page Print this page

SPF Record Conformant Domain Logo