1

Question: How to handle DNs like this in Active Directory:

"myAttribute1=val1 + myAttribute2=val2 + myAttribute3=val3, OU=instance1, DC=adtest"

Note: I don't have a CN here, the RDN is solely defined by custom defined classes myAttribute1, myAttribute2 and myAttribute3.

Details: I have a schema description that I have to migrate vom OpenDS to Active Directory.

But it seems that multi-valued RDNs are a problem in Active Directory.

A lookup with the DN mentioned above works fine in OpenDS. But when I do the same lookup in Active Directory, I get this exception:

javax.naming.InvalidNameException: "myAttribute1=val1 + myAttribute2=val2 myAttribute3=val3": [LDAP: error code 34 - 0000208F: LdapErr: DSID-0C090715, comment: Error processing name, data 0, v1db1 ];

Here are my schema definitions. First in OpenDS:

objectClasses: ( 1.3.6.1.4.1.99.2
  NAME 'myNewClass'
  SUP top STRUCTURAL
  MUST ( myAttribute1 $ myAttribute2 $ myAttribute3 )
  MAY someOtherAttribute
  )

And this is what I did for Active Directory:

# Class: myNewClass
dn: cn=myNewClass,cn=Schema,cn=Configuration,dc=X
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.99.2
ldapDisplayName: myNewClass
adminDisplayName: myNewClass
objectClassCategory: 0
systemOnly: FALSE
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: myAttribute1 
rdnAttId: 1.3.6.1.4.1.99.1
# mustContain: myAttribute2 
mustContain: 1.3.6.1.4.1.99.2
# mustContain: myAttribute3 
mustContain: 1.3.6.1.4.1.99.3
# mayContain: someOtherAttribute
mayContain: 1.3.6.1.4.1.99.4
# possSuperiors: organizationalUnit
possSuperiors: 2.5.6.5
# defaultObjectCategory: myNewClass
defaultObjectCategory: cn=myNewClass,cn=Schema,cn=Configuration,dc=X

I assume the problem is related to rdnAttId - I'm not sure which value I should put there. First I've tried to put CN there -> did not work. Second I've tried to use any of my custom defined attributes (myAttribute1) -> did not work either.

Frizz
  • 2,524
  • 6
  • 31
  • 45

1 Answers1

4

After some research: It seems to be not possible to use/define multivalued RDNs in Active Directory.

See: http://msdn.microsoft.com/en-us/library/cc223237.aspx

Quote: "... [RFC2253] section 2 defines the following grammar rule for RelativeDistinguishedName, which explicitly allows RDNs to contain multiple attributes and values:

RelativeDistinguishedName ::= SET SIZE (1..MAX) OF AttributeTypeAndValue

Active Directory is conformant with this rule, with the restriction that MAX equals 1 within the scope of the rule. ...".

LOL ( -> "MAX equals 1").

Frizz
  • 2,524
  • 6
  • 31
  • 45