Subject: attribute length restrictions

From: Norbert Klasen <[email-masked]>
Date: Mon, 27 Aug 2001 18:58:26 +0200

Hi,
it seems there is a mismatch between length restrictions for standard 
attribute types as specified in X.520v3 and LDAPv3:

X.520, section 5.2.2
commonName ATTRIBUTE	::=	{
	SUBTYPE OF		name
	WITH SYNTAX		DirectoryString {ub-common-name}
	ID			id-at-commonName }

X.520, annex C
ub-name			INTEGER	::=	32768
ub-common-name	INTEGER	::=	64

(Note: In X520_4thEditionDraftv5 ub-name now also is 64.)

draft-ietf-ldapbis-user-schema-00, section 3.2.2
    ( 2.5.4.41 NAME 'name' EQUALITY caseIgnoreMatch
      SUBSTR caseIgnoreSubstringsMatch
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )

draft-ietf-ldapbis-user-schema-00, section 3.2.38
    ( 2.5.4.3 NAME 'cn' SUP name )

This would restrict commonName in X.500 to 64 characters, while it could 
hold up to 32768 characters in LDAP. Same for o and ou (and sn?). Has this 
deviation been made deliberately?

P.S.: Personally, I would like to use the larger limits because in Germany 
names for academic institutions easily exceed 64 characters. However, this 
would probably lead to problems in maintaining an identical data set on the 
FLDSA and standalone LDAP servers.

-- 
Norbert Klasen
DAASI International GmbH                 phone: +49 7071 2970336
Wilhelmstr. 106                          fax:   +49 7071 295114
72074 Tübingen                           email: [email-masked]
Germany                                  web:   http://www.daasi.de

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 27 Aug 2001 13:38:42 -0700

At 09:58 AM 2001-08-27, Norbert Klasen wrote:
>it seems there is a mismatch between length restrictions for standard attribute types as specified in X.520v3 and LDAPv3:

In LDAPv3, the len value is a "suggested upper minimum bound", not
a maximum length restriction.  See last paragraph of RFC 2252, 4.3.2.

Kurt

---

From: Steve Miller <[email-masked]>
Date: Mon, 27 Aug 2001 18:20:06 -0400

There is some ambiguity in this regard. The last paragraph of RFC 2252, 4.2, says:

  This document refines the schema description of X.501 by requiring
   that the syntax field in an AttributeTypeDescription be a string
   representation of an OBJECT IDENTIFIER for the LDAP string syntax
   definition, and an optional indication of the maximum length of a
   value of this attribute (defined in section 4.3.2).

Steve

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 27 Aug 2001 15:52:50 -0700

At 03:20 PM 2001-08-27, Steve Miller wrote:
>There is some ambiguity in this regard.

I agree.  I think the specification in 4.3.2, which I believe
should be viewed as definitive, is pretty useless.  It would
have been better to state the minimum upper bound in the text
of the specification (on a per attribute basis) and for length
published in the subschema to represent the actual server
specific constraint.

Kurt

---

From: "Steven Legg" <[email-masked]>
Date: Tue, 28 Aug 2001 12:35:56 +1100

Norbert,

> deviation been made deliberately?

The upper bounds given in X.520 Annex C are suggestions only, though that
fact
isn't widely appreciated. An X.500 implementation is free to use whatever
upper
bounds it likes, so the mechanism in LDAP for specifying a minimum upper
bound
doesn't produce an actual specification conflict for servers implementing
both
X.500 and LDAP. Such a server can, for example, allow commonName attribute
values to contain up to 32768 characters without violating the X.500
standards.

Regards,
Steven