LibraryLink ToToggle FramesPrintFeedback

Distinguished Names

Historically, distinguished names (DN) were defined as the primary keys in an X.500 directory structure. In the meantime, however, DNs have come to be used in many other contexts as general purpose identifiers. In FUSE Services Framework, DNs occur in the following contexts:

  • X.509 certificates—for example, one of the DNs in a certificate identifies the owner of the certificate (the security principal).

  • LDAP—DNs are used to locate objects in an LDAP directory tree.

Although a DN is formally defined in ASN.1, there is also an LDAP standard that defines a UTF-8 string representation of a DN (see RFC 2253). The string representation provides a convenient basis for describing the structure of a DN.


The string representation of a DN does not provide a unique representation of DER-encoded DN. Hence, a DN that is converted from string format back to DER format does not always recover the original DER encoding.

The following string is a typical example of a DN:

C=US,O=IONA Technologies,OU=Engineering,CN=A. N. Other

A DN string is built up from the following basic elements:

An OBJECT IDENTIFIER (OID) is a sequence of bytes that uniquely identifies a grammatical construct in ASN.1.

The variety of attribute types that could appear in a DN is theoretically open-ended, but in practice only a small subset of attribute types are used. Table A.1 shows a selection of the attribute types that you are most likely to encounter:

An attribute value assertion (AVA) assigns an attribute value to an attribute type. In the string representation, it has the following syntax:


For example:

CN=A. N. Other

Alternatively, you can use the equivalent OID to identify the attribute type in the string representation (see Table A.1 ). For example: N. Other

A relative distinguished name (RDN) represents a single node of a DN (the bit that appears between the commas in the string representation). Technically, an RDN might contain more than one AVA (it is formally defined as a set of AVAs); in practice, however, this almost never occurs. In the string representation, an RDN has the following syntax:

<attr-type>=<attr-value>[+<attr-type>=<attr-value> ...] 

Here is an example of a (very unlikely) multiple-value RDN:


Here is an example of a single-value RDN: