ldap_get_dn, ldap_explode_dn, ldap_explode_rdn, ldap_dn2ufn − LDAP DN handling routines


OpenLDAP LDAP (libldap, −lldap)


#include <ldap.h>

char *ldap_get_dn( LDAP *ld, LDAPMessage *entry )

int ldap_str2dn( const char *str, LDAPDN *dn, unsigned flags )

void ldap_dnfree( LDAPDN dn )

int ldap_dn2str( LDAPDN dn, char **str, unsigned flags )

char **ldap_explode_dn( const char *dn, int notypes )

char **ldap_explode_rdn( const char *rdn, int notypes )

char *ldap_dn2ufn( const char * dn )

char *ldap_dn2dcedn( const char * dn )

char *ldap_dcedn2dn( const char * dn )

char *ldap_dn2ad_canonical( const char * dn )


These routines allow LDAP entry names (Distinguished Names, or DNs) to be obtained, parsed, converted to a user-friendly form, and tested. A DN has the form described in RFC 4414 "Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names".

The ldap_get_dn() routine takes an entry as returned by ldap_first_entry(3) or ldap_next_entry(3) and returns a copy of the entry’s DN. Space for the DN will be obtained dynamically and should be freed by the caller using ldap_memfree(3).

ldap_str2dn() parses a string representation of a distinguished name contained in str into its components, which are stored in dn as ldap_ava structures, arranged in LDAPAVA, LDAPRDN, and LDAPDN terms. Space for dn will be obtained dynamically and should be freed by the caller using ldap_dnfree(3). The LDAPDN is defined as:

typedef struct ldap_ava {
char *la_attr;
struct berval *la_value;
unsigned la_flags;


The attribute types and the attribute values are not normalized. The la_flags can be either LDAP_AVA_STRING or LDAP_AVA_BINARY, the latter meaning that the value is BER/DER encoded and thus must be represented as, quoting from RFC 4514, " ... an octothorpe character (’#’ ASCII 35) followed by the hexadecimal representation of each of the bytes of the BER encoding of the X.500 AttributeValue." The flags parameter to ldap_str2dn() can be




which defines what DN syntax is expected (according to RFC 4514, RFC 1779 and DCE, respectively). The format can be ORed to the flags





The latter is a shortcut for all the previous limitations.

LDAP_DN_P_NO_SPACES does not allow extra spaces in the dn; the default is to silently eliminate spaces around AVA separators (’=’), RDN component separators (’+’ for LDAPv3/LDAPv2 or ’,’ for DCE) and RDN separators (’,’ LDAPv3/LDAPv2 or ’/’ for DCE).

LDAP_DN_P_NO_SPACE_AFTER_RDN does not allow a single space after RDN separators.

ldap_dn2str() performs the inverse operation, yielding in str a string representation of dn. It allows the same values for flags as ldap_str2dn(), plus



for user-friendly naming (RFC 1781) and AD canonical.

The following routines are viewed as deprecated in favor of ldap_str2dn() and ldap_dn2str(). They are provided to support legacy applications.

The ldap_explode_dn() routine takes a DN as returned by ldap_get_dn() and breaks it up into its component parts. Each part is known as a Relative Distinguished Name, or RDN. ldap_explode_dn() returns a NULL-terminated array, each component of which contains an RDN from the DN. The notypes parameter is used to request that only the RDN values be returned, not their types. For example, the DN "cn=Bob, c=US" would return as either { "cn=Bob", "c=US", NULL } or { "Bob", "US", NULL }, depending on whether notypes was 0 or 1, respectively. Assertion values in RDN strings may included escaped characters. The result can be freed by calling ldap_value_free(3).

Similarly, the ldap_explode_rdn() routine takes an RDN as returned by ldap_explode_dn(dn,0) and breaks it up into its "type=value" component parts (or just "value", if the notypes parameter is set). Note the value is not unescaped. The result can be freed by calling ldap_value_free(3).

ldap_dn2ufn() is used to turn a DN as returned by ldap_get_dn(3) into a more user-friendly form, stripping off all type names. See "Using the Directory to Achieve User Friendly Naming" (RFC 1781) for more details on the UFN format. Due to the ambiguous nature of the format, it is generally only used for display purposes. The space for the UFN returned is obtained dynamically and the user is responsible for freeing it via a call to ldap_memfree(3).

ldap_dn2dcedn() is used to turn a DN as returned by ldap_get_dn(3) into a DCE-style DN, e.g. a string with most-significant to least significant rdns separated by slashes (’/’); rdn components are separated by commas (’,’). Only printable chars (e.g. LDAPv2 printable string) are allowed, at least in this implementation. ldap_dcedn2dn() performs the opposite operation. ldap_dn2ad_canonical() turns a DN into a AD canonical name, which is basically a DCE dn with attribute types omitted. The trailing domain, if present, is turned in a DNS-like domain. The space for the returned value is obtained dynamically and the user is responsible for freeing it via a call to ldap_memfree(3).


If an error occurs in ldap_get_dn(), NULL is returned and the ld_errno field in the ld parameter is set to indicate the error. See ldap_error(3) for a description of possible error codes. ldap_explode_dn(), ldap_explode_rdn(), ldap_dn2ufn(), ldap_dn2dcedn(), ldap_dcedn2dn(), and ldap_dn2ad_canonical() will return NULL with errno(3) set appropriately in case of trouble.


These routines dynamically allocate memory that the caller must free.


ldap(3), ldap_error(3), ldap_first_entry(3), ldap_memfree(3), ldap_value_free(3)


OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from University of Michigan LDAP 3.3 Release.

More Linux Commands

Mail::SpamAssassin::Message(3pm) - decode, render, and hold
This module encapsulates an email message and allows access to the various MIME message parts and message metadata. The message structure, after initiating a pa

XML::SAX::Base(3pm) - Base class SAX Drivers and Filters....
This module has a very simple task - to be a base class for PerlSAX drivers and filters. Its default behaviour is to pass the input directly to the output uncha

tiff2bw(1) convert a color TIFF image to greyscale..........
Tiff2bw converts an RGB or Palette color TIFF image to a greyscale image by combining percentages of the red, green, and blue channels. By default, output sampl

def_prog_mode_sp(3ncurses) - curses screen-pointer extension
This implementation can be configured to provide a set of functions which improve the ability to manage multiple screens. This feature can be added to any of th

apparmor.vim(5) vim syntax highlighting file for AppArmor pr
apparmor.vim provides syntax highlighting rules for the vim(1) text editor; the rules provide an easy visual method to inspect AppArmor profiles for syntax corr

goa-daemon(8) - GNOME Online Accounts Daemon (Man Page).....
The goa-daemon program provides the org.gnome.OnlineAccounts name on the session message bus. Users or administrators should never need to start this daemon as

intel_reg_write(1) - Set an Intel GPU register to a value...
intel_reg_write is a tool to set Intel GPU registers to values, for use in speeding up debugging. The register and value arguments are given as hexadecimal. EXA

systemd-shutdown(8) System shutdown logic - Linux man page
systemd-halt.service is a system service that is pulled in by halt.target and is responsible for the actual system halt. Similarly, systemd-poweroff.service is

sqrtf(3) - square root function (Library - Linux man page)
The sqrt() function returns the nonnegative square root of x. RETURN VALUE On success, these functions return the square root of x. If x is a NaN, a NaN is retu

pdbimgtopam(1) - convert a Palm Pilot Image Viewer PDB Image
This program is part of Netpbm(1) pdbimgtopam reads a Palm Pilot Image Viewer image (and Image record in a PDB file) as input, from Standard Input or palmfile,

411toppm(1) - convert Sony Mavica .411 image to PPM lbAC....
This program is part of Netpbm(1) 411toppm reads a .411 file, such as from a Sony Mavic camera, and converts it to a PPM image as output. Output is to Standard

dbmerge(1p) - merge splited DocBook document (Man Page).....
dbmerge process xi:include elements (see &lt;http://www.w3.org/TR/xinclude/&gt;). That is merge splited XML file to one file. All xml:base attributes (see &lt;http://www

We can't live, work or learn in freedom unless the software we use is free.