rfc2253.txt

Java安全性编程实例,解压看说明

Network Working Group                                            M. Wahl
Request for Comments: 2253                           Critical Angle Inc.
Obsoletes: 1779                                                 S. Kille
Category: Standards Track                                     Isode Ltd.
                                                                T. Howes
                                           Netscape Communications Corp.
                                                           December 1997


              Lightweight Directory Access Protocol (v3):
           UTF-8 String Representation of Distinguished Names

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1997).  All Rights Reserved.

IESG Note

   This document describes a directory access protocol that provides
   both read and update access.  Update access requires secure
   authentication, but this document does not mandate implementation of
   any satisfactory authentication mechanisms.

   In accordance with RFC 2026, section 4.4.1, this specification is
   being approved by IESG as a Proposed Standard despite this
   limitation, for the following reasons:

   a. to encourage implementation and interoperability testing of
      these protocols (with or without update access) before they
      are deployed, and

   b. to encourage deployment and use of these protocols in read-only
      applications.  (e.g. applications where LDAPv3 is used as
      a query language for directories which are updated by some
      secure mechanism other than LDAP), and

   c. to avoid delaying the advancement and deployment of other Internet
      standards-track protocols which require the ability to query, but
      not update, LDAPv3 directory servers.




Wahl, et. al.              Proposed Standard                    [Page 1]

RFC 2253               LADPv3 Distinguished Names          December 1997


   Readers are hereby warned that until mandatory authentication
   mechanisms are standardized, clients and servers written according to
   this specification which make use of update functionality are
   UNLIKELY TO INTEROPERATE, or MAY INTEROPERATE ONLY IF AUTHENTICATION
   IS REDUCED TO AN UNACCEPTABLY WEAK LEVEL.

   Implementors are hereby discouraged from deploying LDAPv3 clients or
   servers which implement the update functionality, until a Proposed
   Standard for mandatory authentication in LDAPv3 has been approved and
   published as an RFC.

Abstract

   The X.500 Directory uses distinguished names as the primary keys to
   entries in the directory.  Distinguished Names are encoded in ASN.1
   in the X.500 Directory protocols.  In the Lightweight Directory
   Access Protocol, a string representation of distinguished names is
   transferred.  This specification defines the string format for
   representing names, which is designed to give a clean representation
   of commonly used distinguished names, while being able to represent
   any distinguished name.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [6].

1.  Background

   This specification assumes familiarity with X.500 [1], and the
   concept of Distinguished Name.  It is important to have a common
   format to be able to unambiguously represent a distinguished name.
   The primary goal of this specification is ease of encoding and
   decoding.  A secondary goal is to have names that are human readable.
   It is not expected that LDAP clients with a human user interface
   would display these strings directly to the user, but would most
   likely be performing translations (such as expressing attribute type
   names in one of the local national languages).

2.  Converting DistinguishedName from ASN.1 to a String

   In X.501 [2] the ASN.1 structure of distinguished name is defined as:

       DistinguishedName ::= RDNSequence

       RDNSequence ::= SEQUENCE OF RelativeDistinguishedName






Wahl, et. al.              Proposed Standard                    [Page 2]

RFC 2253               LADPv3 Distinguished Names          December 1997


       RelativeDistinguishedName ::= SET SIZE (1..MAX) OF
        AttributeTypeAndValue

       AttributeTypeAndValue ::= SEQUENCE {
        type  AttributeType,
        value AttributeValue }

   The following sections define the algorithm for converting from an
   ASN.1 structured representation to a UTF-8 string representation.

2.1. Converting the RDNSequence

   If the RDNSequence is an empty sequence, the result is the empty or
   zero length string.

   Otherwise, the output consists of the string encodings of each
   RelativeDistinguishedName in the RDNSequence (according to 2.2),
   starting with the last element of the sequence and moving backwards
   toward the first.

   The encodings of adjoining RelativeDistinguishedNames are separated
   by a comma character (',' ASCII 44).

2.2.  Converting RelativeDistinguishedName

   When converting from an ASN.1 RelativeDistinguishedName to a string,
   the output consists of the string encodings of each
   AttributeTypeAndValue (according to 2.3), in any order.

   Where there is a multi-valued RDN, the outputs from adjoining
   AttributeTypeAndValues are separated by a plus ('+' ASCII 43)
   character.

2.3.  Converting AttributeTypeAndValue

   The AttributeTypeAndValue is encoded as the string representation of
   the AttributeType, followed by an equals character ('=' ASCII 61),
   followed by the string representation of the AttributeValue.  The
   encoding of the AttributeValue is given in section 2.4.

   If the AttributeType is in a published table of attribute types
   associated with LDAP [4], then the type name string from that table
   is used, otherwise it is encoded as the dotted-decimal encoding of
   the AttributeType's OBJECT IDENTIFIER. The dotted-decimal notation is
   described in [3].  As an example, strings for a few of the attribute
   types frequently seen in RDNs include:





Wahl, et. al.              Proposed Standard                    [Page 3]

RFC 2253               LADPv3 Distinguished Names          December 1997


                    String  X.500 AttributeType
                    ------------------------------
                    CN      commonName
                    L       localityName
                    ST      stateOrProvinceName
                    O       organizationName
                    OU      organizationalUnitName
                    C       countryName
                    STREET  streetAddress
                    DC      domainComponent
                    UID     userid

2.4.  Converting an AttributeValue from ASN.1 to a String

   If the AttributeValue is of a type which does not have a string
   representation defined for it, then it is simply encoded as an
   octothorpe character ('#' ASCII 35) followed by the hexadecimal
   representation of each of the bytes of the BER encoding of the X.500
   AttributeValue.  This form SHOULD be used if the AttributeType is of
   the dotted-decimal form.

   Otherwise, if the AttributeValue is of a type which has a string
   representation, the value is converted first to a UTF-8 string
   according to its syntax specification (see for example section 6 of
   [4]).

   If the UTF-8 string does not have any of the following characters
   which need escaping, then that string can be used as the string
   representation of the value.

    o   a space or "#" character occurring at the beginning of the
        string

    o   a space character occurring at the end of the string

    o   one of the characters ",", "+", """, "\", "<", ">" or ";"

   Implementations MAY escape other characters.

   If a character to be escaped is one of the list shown above, then it
   is prefixed by a backslash ('\' ASCII 92).

   Otherwise the character to be escaped is replaced by a backslash and
   two hex digits, which form a single byte in the code of the
   character.

   Examples of the escaping mechanism are shown in section 5.




Wahl, et. al.              Proposed Standard                    [Page 4]

RFC 2253               LADPv3 Distinguished Names          December 1997


3. Parsing a String back to a Distinguished Name

   The structure of the string is specified in a BNF grammar, based on
   the grammar defined in RFC 822 [5].  Server implementations parsing a
   DN string generated by an LDAPv2 client MUST also accept (and ignore)
   the variants given in section 4 of this document.

distinguishedName = [name]                    ; may be empty string

name       = name-component *("," name-component)

name-component = attributeTypeAndValue *("+" attributeTypeAndValue)

attributeTypeAndValue = attributeType "=" attributeValue

attributeType = (ALPHA 1*keychar) / oid
keychar    = ALPHA / DIGIT / "-"

oid        = 1*DIGIT *("." 1*DIGIT)

attributeValue = string

string     = *( stringchar / pair )
             / "#" hexstring
             / QUOTATION *( quotechar / pair ) QUOTATION ; only from v2

quotechar     = <any character except "\" or QUOTATION >

special    = "," / "=" / "+" / "<" /  ">" / "#" / ";"

pair       = "\" ( special / "\" / QUOTATION / hexpair )
stringchar = <any character except one of special, "\" or QUOTATION >

hexstring  = 1*hexpair
hexpair    = hexchar hexchar

hexchar    = DIGIT / "A" / "B" / "C" / "D" / "E" / "F"
             / "a" / "b" / "c" / "d" / "e" / "f"

ALPHA      =  <any ASCII alphabetic character>
                                         ; (decimal 65-90 and 97-122)
DIGIT      =  <any ASCII decimal digit>  ; (decimal 48-57)
QUOTATION  =  <the ASCII double quotation mark character '"' decimal 34>








Wahl, et. al.              Proposed Standard                    [Page 5]

RFC 2253               LADPv3 Distinguished Names          December 1997