Re: people CN

[[e-mail]]

Just to throw in my tuppence worth..., I should like to say that
my preferred solution is to use a multi-value RDN.  For
preference I would use organizationalUnit as the disambiguating
attribute, although I accept that it has some of the same
problems as already discusses, as I think that I have seen it
recommended somewhere else.  There will always be exception
cases when the disambiguating mecahnism does not use something
like arbitrary serial numbers.

As Walter mentioned earlier, at UBS we use a serial number on
the end of the commonName (just for the ambiguous entries) and
this works well enough but, as others have pointed out, gives
nothing in the returned list of DNs which will help a user
choose the right one.  The problem with saying that the DUA
should present the user with some other attributes means that
these all entries must be read first, which could be significant
in an organisation using a flat DIT structure.

Our structure, here in Zurich, is:
	
	locality=Zuerich@organizationalUnit=xxx@cn=yyy

where 'yyy' is unique (using a serial number suffix if necessary)
within locality=Zuerich, so one could regard the OU as a
disambiguating part of the RDN, and in practice this is useful,
and nearly always adequate, for determining the correct
selection..

Alan Young.