Re: Use of dnQualifier must be settled

[Russ Housley <[e-mail]>]

Interpretation 1 cannot be correct.  The DIT can be reallocated among DSAs, 
and this would result in name changes.  For example: assume that c=XX, 
O=Acme was handled by one DSA, but the organization grew so that a second 
DSA was added.  The new partition might be so that all of c=XX, o=Acme, 
ou=Sales was moved to the new DSA.  I would hope that this adjustment would 
nt cause any names to change.

Russ

At 04:00 PM 11/16/99 +0100, Stefan Santesson wrote:
>We must come to a common understanding on what the defined usage of
>dnQualifier is according to X.520.
>
>X.520 defines:
>--------------
>5.2.8 DN Qualifier
>The DN Qualifier attribute type specifies disambiguating information to add
>to the relative distinguished name of an entry. It is intended to be used
>for entries held in multiple DSAs which would otherwise have the same name,
>and that its value be the same in a given DSA for all entries to which this
>information has been added.
>[DSA = Directory System Agent, basically a directory server]
>-------------------
>
>Lets apply this to two DSA which in this case is represented by a group of
>entries each.
>
>DSA 1 group:            DSA 2 group:
>1) CN="Alice"           1) CN="Alice"
>2) CN="Bob"             2) CN="Bob"
>3) CN="Bob"             3) CN="Fred"
>
>
>INTERPRETATION 1:
>-----------------
>One interpretation (Manger) is that this means that dnQualifier is defined
>to disambiguate names between independent domains (DSA). In this case group
>1 above is invalid because names within in a group must be unique also
>without dnQualifier. but if we delete 3) from group 1 we can then use
>dnQualifier to disambiguate Alice and Bob btween group 1 and 2. dnQualifier
>is used to give all entries a common disambiguating value for each group.
>
>Ex.
>DSA 1 group:                  DSA 2 group:
>1) CN="Alice", DNQ="Grp 1"    1) CN="Alice", DNQ="Grp 2"
>2) CN="Bob", DNQ="Grp 1"      2) CN="Bob", DNQ="Grp 2"
>                               3) CN="Fred"
>
>Note that DNQ is not added to "Fred" since that is not needed.
>
>
>INTERPRETATION 2
>-----------------
>
>Interpretation 2 is the current interpretation behind the current rfc2459
>and also the interpretation in the QC profile. This interpretation says
>that dnQualifier can be used to disambiguate any name from any other name,
>regardless of whether these names are located within the same group or not.
>
>In this case the example groups may look like this:
>DSA 1 group:                  DSA 2 group:
>1) CN="Alice", DNQ="1"        1) CN="Alice", DNQ="2"
>2) CN="Bob", DNQ="1"          2) CN="Bob", DNQ="3"
>2) CN="Bob", DNQ="2"          3) CN="Fred", DNQ="1"
>
>It could also be used to store unique values like this:
>DSA 1 group:                  DSA 2 group:
>1) CN="Alice", DNQ="01"       1) CN="Alice", DNQ="11"
>2) CN="Bob", DNQ="02"         2) CN="Bob", DNQ="12"
>2) CN="Bob", DNQ="03"         3) CN="Fred", DNQ="13"
>
>
>
>Now we need to settle once and for all.....
>
>Is interpretation 1 or 2 the right one.
>
>Please be active on this one because it is VERY important that we agree on
>a consensus here very soon.
>
>
>/Stefan
>
>
>-------------------------------------------------------------------
>Stefan Santesson                <[e-mail]>
>Accurata AB                     http://www.accurata.se
>Slagthuset                      Tel. [phone]
>211 20  Malmö                   Fax. [phone]
>Sweden                        Mobile [phone]
>
>PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
>-------------------------------------------------------------------