Subject: Re: dubble O

From: "Tom Gindin" <[email-masked]>
Date: Mon, 11 Nov 2002 10:10:27 -0500

Haaino:

      Not everything relevant to DN's can be found in RFC's.  In
particular, RFC 2587 doesn't say much about DN's, and neither does its
LDAPv3 replacement.  However, this stuff is covered in X.520 and X.521.
Reading the text of X.520, the relevant text about O and OU does not make
it clear why O should not be permitted multiple values.  The only place I
could easily find which distinguishes the two is the (non-binding) Annex B
of X.521, in which Locality and OU are the only object classes which may
serve as their own direct subordinates in the recommended DIT, and thus
their attributes are the only ones which can be repeated consecutively as
in your example.  You can, of course, use a DIT which doesn't match this if
you like, but the most standard DIT layout only allows one consecutive O
attribute (although multiple OU's).

            Tom Gindin

"Haaino Beljaars" <[email-masked]>@mail.imc.org on 01/30/2002
03:44:34 AM

Sent by:    [email-masked]

To:    [email-masked], <[email-masked]>
cc:
Subject:    dubble O

Hi,

Can somebody tell me if the following hierachie is technical as well as
legally possible: DN:= C=nl, O = ABC, O = XYZ, OU = dep, CN = user

If not, in which RFC('s) is that defined?

Thank you,
Haaino