Using Domains in LDAP/X.500 Distinguished Names
updated by
Extracted elements (11)
DNS provides hierarchical resource labeling with short string components, while LDAP distinguished names differ by requiring explicit attribute type indicators for each component. This document bridges the two by defining an algorithmic mapping from DNS names to LDAP DNs, automatically providing enterprises a distinguished name for each Internet domain name they hold.
The dcObject class is defined as auxiliary rather than structural because it would typically be combined with an existing structural object class. For example, if a domain represents a particular organization, the entry's structural class would be 'organization' and dcObject would be added as an auxiliary class.
The 'domain' structural object class exists for cases where the entry does not correspond to an organization, organizational unit, or other type with an existing defined object class. It provides a generic container for DNS-derived entries such as placeholder entries used with SRV records.
The equality matching rule for the DC attribute is case insensitive, consistent with DNS which is also case insensitive today. The encoding of IA5String for use in LDAP is simply the characters of the string itself.
Distinguished names in which there are one or more RDNs, all containing only the attribute type DC, can be mapped back into domain names. This document does not define a domain name equivalence for any other distinguished names.
The algorithm for transforming a domain name into a distinguished name begins with an empty DN, then attaches RDNs for each domain component starting with the most significant (rightmost) component first. Each RDN is a single AttributeTypeAndValue where the type is 'DC' and the value is an IA5 string containing that domain component.
The DC (domainComponent) attribute type is defined with OID 0.9.2342.19200300.100.1.25, using caseIgnoreIA5Match equality, caseIgnoreIA5SubstringsMatch substring matching, and IA5String syntax (1.3.6.1.4.1.1466.115.121.1.26). It is SINGLE-VALUE and holds one component of a domain name.
The dcObject object class (OID 1.3.6.1.4.1.1466.344) is an AUXILIARY class that SUPs top and requires the dc attribute (MUST dc). It is intended for use in conjunction with an existing structural object class such as organization, organizationalUnit, or locality.
The domain object class (OID 0.9.2342.19200300.100.4.13) is a STRUCTURAL class that SUPs top, requires dc (MUST dc), and permits a broad set of optional attributes including userPassword, searchGuide, description, o, and many postal/telecom attributes. It is used for entries that are placeholders or whose domains do not correspond to real-world entities.
The domainNameForm name form rule (OID 1.3.6.1.4.1.1466.345) specifies that the DC attribute is used as the mandatory naming attribute for entries of the domain object class, representable in X.500 servers.
Servers should ensure that an appropriate security policy is maintained when attributes of objects are discovered and retrieved. A client contacting an untrusted server may receive incorrect or misleading information, such as an organization's server falsely claiming to hold naming contexts for domain names not delegated to that organization.