Re: To quote or escape?

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 02:38 PM 3/13/00 -0500, Mike Douglass wrote:
>I'm evaluating ldap servers and I'm having a (possible) problem with <comma>
>
>We have some entries with <comma> in the ou. For example we have
>
>ou="Electrical, Computer and Systems Engineering"
>
>or
>
>ou=Electrical\, Computer and Systems Engineering
>
>I would have expected that these two would be equivalent.

No.  These are different attribute values, and so is:

ou=Electrical, Computer and Systems Engineering


Now, if you use this value in a DN, you must quote/escape the value.
so:

dn: ou="Electrical, Computer and Systems Engineering"

and

dn: ou=Electrical\, Computer and Systems Engineering


*SHOULD* be the same.  [Note: attribute value quoting/escaping requirements differ
from RDN value quoting/escaping requirements].

slapd (and many applications), however, treats DNs as simple strings and does
not enforce RDN naming rules.  So the above two DN are (incorrectly) considered
to be the same and the value used need not really exist.  I suggest you avoid RDN
values that require quoting/escaping.  I suggest something like:

dn: ou=ECSE, ...
ou: ECSE
ou: Electrical, Computer and Systems Engineering
...


>However, if I 
>quote it that's what ends up in the dn, similarly if I escape it. The entry 
>looks like:
>
>dn: ou=Electrical\, Computer and Systems Engineering, o=Rensselaer 
>Polytechnic Institute, c=US
>telephoneNumber: 518-555-5555
>facsimileTelephoneNumber: 518 555-5555
>objectclass: top
>objectclass: organizationalunit
>ou: Electrical\, Computer and Systems Engineering

This is wrong.  Should be:

dn: ou=Electrical\, Computer and Systems Engineering, ...
ou: Electrical, Computer and Systems Engineering
...

or
dn: ou="Electrical, Computer and Systems Engineering", ...
ou: Electrical, Computer and Systems Engineering

>If I add entries to the above, I have to escape the comma in the same way. 

No.  You should escape the value when used as part of the RDN.

>Is this expected behaviour?

OpenLDAP doesn't check naming restrictions... I would say that's not the
expected behavior.