Distinguished Names

Distinguished Names (DNs) are the string representation for entry names in the Directory Server database. You use DNs to name entries when you add entries to the directory, add members to groups, etc..

A DN can consist of virtually any attributes you wish to use. The only caveat is that if schema checking is turned on, then the attributes must be recognized by the Directory Server (if you do not know whether schema checking is turned on in the server, contact your directory manager, or consult the Directory Server Administrator's Guide for more information).

Traditionally, a DN consists of:

This string of identifying attributes uniquely locates the entry within your Directory Server database. If you choose, you can also use this naming structure to uniquely identify your entries within the global directory tree as defined in the X.500 standard.

Because a DN represents a path through the directory tree, the DN components are order-dependent. For example, the following DNs do not represent the same entry:

          cn=Ralph Swenson, ou=Accounting, o=Example Corp, c=US
          cn=Ralph Swenson, o=Example Corp, ou=Accounting, c=US

Distinguished Name syntax

The traditional syntax for a DN string representation is as follows:

Generally a DN begins with a specific common name, and proceeds with increasingly broader areas of identification until the country name is specified. Note, however, that the actual DN attributes you use, and the order in which you choose to specify them, is up to you and how you want to organize your database. The only real requirement is that DN attributes must be separated by a comma (,) and can optionally use a space ( ) following the separator.

Distinguished Name attributes

The various standard attributes that comprise a DN are as follows:

Attribute Name Definition
c country Identifies the name of the country under which the entry resides. For example,

  • c=US
  • c=GB
cn common name Required attribute that identifies the person or object defined by the entry. For example:

  • cn=Wally Henderson
  • cn=Database Administrators
  • cn=printer3b
l locality Identifies the locality in which the entry resides. The locality could be a city, county, township, or other geographic region. For example:

  • l=Tucson
  • l=Pacific Northwest
  • l=Anoka County
o organization Identifies the organization in which the entry resides. For example:

  • o=Example Corp
  • o=Public Power & Gas
ou organizational unit Identifies a unit within the organization. For example:

  • ou=Sales
  • ou=Manufacturing
st state or province name Identifies the state or province in which the entry resides. For example:

  • st=Iowa
  • st=British Columbia
street street address Identifies the street address at which the entry resides. For example:

  • street=494 Rice Creek Terrace

Distinguished Name examples

The following are some examples of DNs: