Subject: Re: Fw: Reserved characters for a LDAP URI

From: John McMeeking <[email-masked]>
Date: Mon, 23 Dec 2002 11:52:30 -0600

I'd start with the proper string representation of the URL (from RFC2253),
which states that the "," in the ou value should be escaped as "\2C"

ou=PKI IWG,o=Chunghwa Telecom Co.\2C Ltd.,c=TW

From there, convert the string form of the DN to a URL, replacing the space
(%20) and \ (%5C) characters:

ou=PKI%20IWG,o=Chunghwa%20Telecom%20Co.%5C2C%20Ltd.,c=TW

John  McMeeking

                      Michael Ströder                                                                                        
                      <[email-masked]        To:       Wen-Cheng Wang <[email-masked]>                               
                      m>                          cc:       [email-masked], [email-masked]                     
                      Sent by:                    Subject:  Re: Fw: Reserved characters for a LDAP URI                       
                      owner-ietf-ldapbis@O                                                                                   
                      penLDAP.org                                                                                            

                      12/23/2002 04:48 AM                                                                                    

Wen-Cheng Wang wrote:
>
> Taiwan side believes that the DN component in a LDAP URI should
> be:
>
> ou=PKI%20IWG,o=Chunghwa%20Telecom%20Co.%5C,%20Ltd.,c=TW
>
> However, Japan side insists that it should be:
>
> ou=PKI%20IWG,o=Chunghwa%20Telecom%20Co.%5C%2C%20Ltd.,c=TW

There is one more possibility. ;-)

ou%3DPKI%20IWG%2Co%3DChunghwa%20Telecom%20Co.%5C%2C%20Ltd.%2Cc%3DTW

I think in case of LDAP URLs all these variants are equivalent.

 From RFC2255:

    Note that any URL-illegal characters (e.g., spaces), URL special
    characters (as defined in section 2.2 of RFC 1738) and the reserved
    character '?' (ASCII 63) occurring inside a dn, filter, or other
    element of an LDAP URL MUST be escaped using the % method described
    in RFC 1738 [5]. If a comma character ',' occurs inside an extension
    value, the character MUST also be escaped using the % method.

As I understand this the ',' MUST be escaped in extensions but MAY be
escaped in dn, filter, etc. as well.

Ciao, Michael.

---

From: Michael Ströder <[email-masked]>
Date: Tue, 24 Dec 2002 15:36:39 +0100

Wen-Cheng Wang wrote:
> 
> It seems that LDAPbis now prefer the comma character ',' be escaped as
> "\2C", but alternatively it can also be escaped as "\,".

This and all the URL-escaping examples show clearly that implementations 
should be prepared to handle all sorts of DN- and URL-escaping. Therefore 
the debate about the one and only right way will be endless.

Ciao, Michael.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 26 Dec 2002 00:33:33 -0800

At 12:46 AM 12/24/2002, Wen-Cheng Wang wrote:
>It seems that RFC 2253 requires that the comma character ',' inside
>a RDN AttributeVALue must be escaped as "\," rather than "\2C".
>I think RFC 2253 does not allow the comma character ',' be escaped
>as "\2C". 

The Section 4 ABNF clearly allows the comma to be encoded as
"\2c" or "\2C".  While one could take the Section 3 as restricting implementations, the text is generally not viewed as mandating
one particular escaping of the comma.  This has been clarified
in draft-ietf-ldapbis-dn.

Kurt