Subject: Re: Fw: Reserved characters for a LDAP URI

From: Michael Ströder <[email-masked]>
Date: Mon, 23 Dec 2002 11:48:11 +0100

Wen-Cheng Wang wrote:
> 
> Taiwan side believes that the DN component in a LDAP URI should
> be:
> 
> ou=PKI%20IWG,o=Chunghwa%20Telecom%20Co.%5C,%20Ltd.,c=TW
> 
> However, Japan side insists that it should be:
> 
> ou=PKI%20IWG,o=Chunghwa%20Telecom%20Co.%5C%2C%20Ltd.,c=TW

There is one more possibility. ;-)

ou%3DPKI%20IWG%2Co%3DChunghwa%20Telecom%20Co.%5C%2C%20Ltd.%2Cc%3DTW

I think in case of LDAP URLs all these variants are equivalent.

 From RFC2255:

    Note that any URL-illegal characters (e.g., spaces), URL special
    characters (as defined in section 2.2 of RFC 1738) and the reserved
    character '?' (ASCII 63) occurring inside a dn, filter, or other
    element of an LDAP URL MUST be escaped using the % method described
    in RFC 1738 [5]. If a comma character ',' occurs inside an extension
    value, the character MUST also be escaped using the % method.

As I understand this the ',' MUST be escaped in extensions but MAY be 
escaped in dn, filter, etc. as well.

Ciao, Michael.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 24 Dec 2002 08:18:27 -0800

At 11:57 PM 12/21/2002, you wrote:
>For example, for the following DN:
>  cuntry name: TW
>  organization name: Chunghwa Telecom Co., Ltd.
>  organizational unit name: PKI IWG

First, one needs to construct an LDAP DN string representation
of the DN to encode into the URL.  With minimal escaping, the DN
could be represented as:
       ou=PKI IWG,o=Chunghwa Telecom Co.\2C Ltd.,c=TW
or,
       ou=PKI IWG,o=Chunghwa Telecom Co.\2c Ltd.,c=TW

or, optionally,
        ou=PKI IWG,o=Chunghwa Telecom Co.\, Ltd.,c=TW

Of course, implementations are free to escape other characters
as they see fit.  RFC 2253 does not provide a canonical string
representation of a DN (nor is the string reversible to DER).

Second, the DN strings can be encoded into URLs as follows:
       ldap:///ou=PKI%20IWG,o=Chunghwa%20Telecom Co.%5C2C%20Ltd.,c=TW
       ldap:///ou=PKI%20IWG,o=Chunghwa%20Telecom Co.%5C2c%20Ltd.,c=TW
        ldap:///ou=PKI%20IWG,o=Chunghwa%20Telecom Co.%5C,%20Ltd.,c=TW

respectively.

>(The difference is between "%5C,%20" and "%5C%2C%%20".)

It is not necessary (but allowed) to escape commas when encoding
a DN string into the DN part of an LDAP URL.  That is, "," is
considered to be safe.

The logic that extra escaping in the latter case is necessary
is flawed as there is no ambiguity as to which DN string the first
decodes to.  I think proponents of the first confuse decoding
of the DN part with decoding of the DN string to obtain RDNs.
One cannot decode the RDN strings from the DN part directly.
One must first decode the DN string from the DN part before
the RDN strings can be extracted.

Mark, maybe an additional example should be added to RFC 2255bis
to clarify this?

Kurt