Use of dnQualifier must be settled

[Stefan Santesson <[e-mail]>]

We must come to a common understanding on what the defined usage of
dnQualifier is according to X.520.

X.520 defines:
--------------
5.2.8 DN Qualifier 
The DN Qualifier attribute type specifies disambiguating information to add 
to the relative distinguished name of an entry. It is intended to be used 
for entries held in multiple DSAs which would otherwise have the same name, 
and that its value be the same in a given DSA for all entries to which this 
information has been added.
[DSA = Directory System Agent, basically a directory server]
-------------------

Lets apply this to two DSA which in this case is represented by a group of
entries each.

DSA 1 group:            DSA 2 group:          
1) CN="Alice"           1) CN="Alice"
2) CN="Bob"             2) CN="Bob"
3) CN="Bob"             3) CN="Fred"


INTERPRETATION 1:
-----------------
One interpretation (Manger) is that this means that dnQualifier is defined
to disambiguate names between independent domains (DSA). In this case group
1 above is invalid because names within in a group must be unique also
without dnQualifier. but if we delete 3) from group 1 we can then use
dnQualifier to disambiguate Alice and Bob btween group 1 and 2. dnQualifier
is used to give all entries a common disambiguating value for each group.

Ex.
DSA 1 group:                  DSA 2 group:          
1) CN="Alice", DNQ="Grp 1"    1) CN="Alice", DNQ="Grp 2"
2) CN="Bob", DNQ="Grp 1"      2) CN="Bob", DNQ="Grp 2"
                              3) CN="Fred"

Note that DNQ is not added to "Fred" since that is not needed.


INTERPRETATION 2
-----------------

Interpretation 2 is the current interpretation behind the current rfc2459
and also the interpretation in the QC profile. This interpretation says
that dnQualifier can be used to disambiguate any name from any other name,
regardless of whether these names are located within the same group or not.

In this case the example groups may look like this:
DSA 1 group:                  DSA 2 group:          
1) CN="Alice", DNQ="1"        1) CN="Alice", DNQ="2"
2) CN="Bob", DNQ="1"          2) CN="Bob", DNQ="3"
2) CN="Bob", DNQ="2"          3) CN="Fred", DNQ="1"

It could also be used to store unique values like this:
DSA 1 group:                  DSA 2 group:          
1) CN="Alice", DNQ="01"       1) CN="Alice", DNQ="11"
2) CN="Bob", DNQ="02"         2) CN="Bob", DNQ="12"
2) CN="Bob", DNQ="03"         3) CN="Fred", DNQ="13"



Now we need to settle once and for all.....

Is interpretation 1 or 2 the right one. 

Please be active on this one because it is VERY important that we agree on
a consensus here very soon.


/Stefan
 

-------------------------------------------------------------------
Stefan Santesson                <[e-mail]>
Accurata AB                     http://www.accurata.se
Slagthuset                      Tel. [phone]              
211 20  Malmö                   Fax. [phone]              
Sweden                        Mobile [phone]

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------