Subject: Re: Fw: Reserved characters for a LDAP URI

From: John McMeeking <[email-masked]>
Date: Mon, 23 Dec 2002 11:52:30 -0600

I'd start with the proper string representation of the URL (from RFC2253),
which states that the "," in the ou value should be escaped as "\2C"

ou=PKI IWG,o=Chunghwa Telecom Co.\2C Ltd.,c=TW

From there, convert the string form of the DN to a URL, replacing the space
(%20) and \ (%5C) characters:

ou=PKI%20IWG,o=Chunghwa%20Telecom%20Co.%5C2C%20Ltd.,c=TW

John  McMeeking

                      Michael Ströder                                                                                        
                      <[email-masked]        To:       Wen-Cheng Wang <[email-masked]>                               
                      m>                          cc:       [email-masked], [email-masked]                     
                      Sent by:                    Subject:  Re: Fw: Reserved characters for a LDAP URI                       
                      owner-ietf-ldapbis@O                                                                                   
                      penLDAP.org                                                                                            

                      12/23/2002 04:48 AM                                                                                    

Wen-Cheng Wang wrote:
>
> Taiwan side believes that the DN component in a LDAP URI should
> be:
>
> ou=PKI%20IWG,o=Chunghwa%20Telecom%20Co.%5C,%20Ltd.,c=TW
>
> However, Japan side insists that it should be:
>
> ou=PKI%20IWG,o=Chunghwa%20Telecom%20Co.%5C%2C%20Ltd.,c=TW

There is one more possibility. ;-)

ou%3DPKI%20IWG%2Co%3DChunghwa%20Telecom%20Co.%5C%2C%20Ltd.%2Cc%3DTW

I think in case of LDAP URLs all these variants are equivalent.

 From RFC2255:

    Note that any URL-illegal characters (e.g., spaces), URL special
    characters (as defined in section 2.2 of RFC 1738) and the reserved
    character '?' (ASCII 63) occurring inside a dn, filter, or other
    element of an LDAP URL MUST be escaped using the % method described
    in RFC 1738 [5]. If a comma character ',' occurs inside an extension
    value, the character MUST also be escaped using the % method.

As I understand this the ',' MUST be escaped in extensions but MAY be
escaped in dn, filter, etc. as well.

Ciao, Michael.

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Tue, 24 Dec 2002 16:46:18 +0800

Dear McMeeking,

Thank you for pointing out the alternative for escaping the comma
character ',' in a LDAP DN string.

It seems that RFC 2253 requires that the comma character ',' inside
a RDN AttributeVALue must be escaped as "\," rather than "\2C".
I think RFC 2253 does not allow the comma character ',' be escaped
as "\2C".

From RFC 2253 Section 2.4:

   If the UTF-8 string does not have any of the following characters
   which need escaping, then that string can be used as the string
   representation of the value.

    o   a space or "#" character occurring at the beginning of the
        string

    o   a space character occurring at the end of the string

    o   one of the characters ",", "+", """, "\", "<", ">" or ";"

   Implementations MAY escape other characters.

   If a character to be escaped is one of the list shown above, then it
   is prefixed by a backslash ('\' ASCII 92).

   Otherwise the character to be escaped is replaced by a backslash and
   two hex digits, which form a single byte in the code of the
   character.

I believe that it means that the special characters listed above must be
"prefixed by a backslash", other characters can be "replaced by a
backslash and two hex digits".

However, LDAPbis seems now allow the comma charachter ',' to be
escaped as "\2C".

From Draft-ietf-ldapbis-dn-08 Section 2.4:

  ...... If that UTF-8 encoded UCS string does not have any
  of the following characters which need escaping, then that string can
  be used as the string representation of the value.

      - a space (" " U+00020) or number sign ("#" U+00023) occurring at
        the beginning of the string;

      - a space (" " U+00020) character occurring at the end of the
        string;

      - one of the characters """, "+", ",", ";", "<", ">",  or "\"
        (U+00022, U+0002B, U+0002C, U+0003B, U+0003C, U+0003E, or
        U+0005C respectively);

      - the null (U+00000) character.

  Other characters may be escaped.

  Each octet of the character to be escaped is replaced by a backslash
  and two hex digits, which form a single octet in the code of the
  character.  Alternatively, if and only if the character to be escaped
  is one of

      " ", """, "#", "+", ",", ";", "<", "=", ">", or "\"
      (U+00020, U+00022, U+00023, U+0002B, U+0002C, U+0003B,
       U+0003C, U+0003D, U+0003E, U+0005C respectively)

  it can be prefixed by a backslash ("\" U+00005C).

It seems that LDAPbis now prefer the comma character ',' be escaped as
"\2C", but alternatively it can also be escaped as "\,".

Since RFC 2253 does not allow the comma character ',' be escaped
as "\2C" but LDAPbis does, I believe that there will be some
back-compatibility issue between RFC 2253 and LDAPbis.

Wen-Cheng Wang
Telecommunication Labs,
Chunghwa Telecom Co., Ltd.

----- Original Message -----
From: "John McMeeking" <[email-masked]>
To: "Michael Ströder" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>;
<[email-masked]>; "Wen-Cheng Wang" <[email-masked]>
Sent: Tuesday, December 24, 2002 1:52 AM
Subject: Re: Fw: Reserved characters for a LDAP URI

>                       m>                          cc:
[email-masked], [email-masked]

---

From: Michael Ströder <[email-masked]>
Date: Tue, 24 Dec 2002 15:36:39 +0100

> "\2C", but alternatively it can also be escaped as "\,".

This and all the URL-escaping examples show clearly that implementations 
should be prepared to handle all sorts of DN- and URL-escaping. Therefore 
the debate about the one and only right way will be endless.

Ciao, Michael.

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Wed, 25 Dec 2002 00:28:45 +0800

> the debate about the one and only right way will be endless.

I totally agree with you. What I argued with Japan PKI IWG members is that

is "one of the correct encodings". Unfortunately, they do not think so. That
is
why I asked for some comments from LDAPbis and PKIX mailing list.

Wen-Cheng Wang
Telecommunication Labs,

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 26 Dec 2002 00:33:33 -0800

>I think RFC 2253 does not allow the comma character ',' be escaped

The Section 4 ABNF clearly allows the comma to be encoded as
"\2c" or "\2C".  While one could take the Section 3 as restricting implementations, the text is generally not viewed as mandating
one particular escaping of the comma.  This has been clarified
in draft-ietf-ldapbis-dn.

Kurt