A distinguished name (DN) is the globally unique name of an entry in the directory tree. It's the LDAP equivalent of a fully-qualified file path — it tells you exactly where an entry lives, and no two entries ever share one.
A DN is a comma-separated list of relative distinguished names (RDNs), ordered from the entry itself (leaf) down to the root of the tree.
CN=Jane Doe,OU=Engineering,OU=Users,DC=example,DC=com- CN=Jane Doe
- OU=Engineering
- OU=Users
- DC=example
- DC=com
Reading that breakdown from top to bottom, each RDN narrows the location by one level, the same way each row's number increases as you move from the leaf toward the root:
CN=Jane Doe— the entry itself.OU=Engineering— the organizational unit it's in.OU=Users— the parent organizational unit.DC=exampleandDC=com— the two domain components that make up the root.
| Attribute | Meaning | Typical use |
|---|---|---|
CN | Common Name | People, groups, computers |
OU | Organizational Unit | Containers/folders in the tree |
DC | Domain Component | Root domain labels |
UID | User ID | Login username, common in OpenLDAP |
O | Organization | Company name (older X.500-style directories) |
Because commas and + separate parts of a DN, a value that contains one of those characters has to be escaped. RFC 4514 defines a backslash-escaping scheme for the characters " + , ; < > \, plus a leading space or #, and a trailing space.
CN=Smith\, John,OU=Users,DC=example,DC=com
Here, Smith\, John is a single RDN value — the backslash tells the parser that the comma is part of the name, not a separator between RDNs. You rarely write this escaping by hand.
DN Parser
Escape and parse DN values in both directions.
Occasionally an RDN has more than one attribute, joined with +:
UID=jdoe+OU=admins,DC=example,DC=com
This is uncommon in day-to-day directory browsing, but it's valid syntax you may run into when parsing DNs produced by other systems.
Security
Never build a DN by directly concatenating untrusted input into a string. Malformed or malicious input can change which entry an operation targets. Parse and re-escape values instead — see LDAP injection.
DNs identify entries. Next, we'll look at what's actually stored inside an entry: Entries and attributes.