Subject: zero-len RDNs

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 20 Sep 2000 10:38:43 -0600

Hey all.

Recently I've encountered a problem where someone was able to add an entry with a zero length RDN, and then was not able to read the entry back. For example, this entry was created:

dn: cn=,o=bar

I'm trying to resolve which half of the problem is the real problem (allowing such an addition, or not being able to resolve the name) and have concluded that both X.501 and RFC 2253 allow you to create an entry with a zero length RDN.

Can anyone verify or dismiss this? It doesn't feel right, but I can't find anywhere in the spec's that disallow it.

Thanks. 

Jim

---

From: Mark Wahl <[email-masked]>
Date: Wed, 20 Sep 2000 10:31:04 -0700

If an attribute's syntax definition allows the representation which 
consists of zero bytes, then an empty string is a legal value for that 
attribute.

I don't think X.520 has a lower bound on the number of characters in 'name'
and the Directory String syntax.  

Mark

---

From: "David Cahlander" <[email-masked]>
Date: Wed, 20 Sep 2000 13:58:00 -0500

Actually Directory String syntax is specified in X.520 Section 2:

5 Definition of selected attribute types

DirectoryString { INTEGER : maxSize } ::= CHOICE {
    teletexString        TeletexString (SIZE(1..maxSize)),
    printableString      PrintableString (SIZE(1..maxSize)),
    universalString      UniversalString (SIZE(1..maxSize)) }

which indicates that the attribute has a minimum length of 1 character.
---
David Cahlander [email-masked] 651-415-3171

----- Original Message -----
From: Mark Wahl <[email-masked]>
Sent: Wednesday, September 20, 2000 12:31 PM
Subject: Re: zero-len RDNs
|
| I don't think X.520 has a lower bound on the number of characters in
'name'
| and the Directory String syntax.