<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:Consolas;
        panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
        {mso-style-priority:99;
        mso-style-link:"Plain Text Char";
        margin:0in;
        margin-bottom:.0001pt;
        font-size:10.5pt;
        font-family:Consolas;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
        {mso-style-priority:99;
        mso-style-link:"Balloon Text Char";
        margin:0in;
        margin-bottom:.0001pt;
        font-size:8.0pt;
        font-family:"Tahoma","sans-serif";}
span.PlainTextChar
        {mso-style-name:"Plain Text Char";
        mso-style-priority:99;
        mso-style-link:"Plain Text";
        font-family:Consolas;}
span.BalloonTextChar
        {mso-style-name:"Balloon Text Char";
        mso-style-priority:99;
        mso-style-link:"Balloon Text";
        font-family:"Tahoma","sans-serif";}
span.EmailStyle21
        {mso-style-type:personal;
        font-family:"Calibri","sans-serif";
        color:windowtext;}
span.EmailStyle22
        {mso-style-type:personal-reply;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-size:10.0pt;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
        {page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='color:#1F497D'>Hello Tridge. Here is what I
have (pending the proposed changes for [MS-ADTS]:<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>The length of a delete-mangled
RDN may indeed exceed rangeUpper, due to the additional delete-mangle
decoration.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>I should first note that the
delete-mangled RDN format contains a ‘\0A’ character - not a ‘\0’. Perhaps this
is a typo in your email?<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>\0A is a character not allowed
in Active Directory names, per [MS-ADTS] 3.1.1.5.1.2 – and is certainly a handy
way to verify whether or not a name has been mangled (a.k.a. strchr(pszRDN, (int)0x0a)
).<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>The format is, of course, noted
in [MS-ADTS] 3.1.1.5.5 , like
"objectName\0ADEL:dashed_string_objectGUID". As noted in [MS-ADTS]
3.1.1.5.1.2. the maximum RDN length is 255; it is further constrained to 64
([MS-ADA1] 2.110 Attribute cn, rangeUpper: 64).<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>That said, the length of a
delete-mangled RDN can be up to 105 characters (not including the terminating
NUL character): {rangeUpper:64} + {0x0A:1} + {'DEL:':4} +
{dashed-string-Guid:36}.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>[MS-ADTS] 3.1.1.5.1.2 also notes
that "Naming constraints are not enforced for replicated updates.",
so the additional length of a delete-mangled RDN will replicate properly.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>I have filed a TDI against
[MS-ADTS] section 3.1.1.5.5 Delete Operation to have this annotated.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>References:<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>[MS-ADTS]: Active Directory
Technical Specification<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>3.1.1.5.1.2 Naming Constraints<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>During an originating update of
the Add, Modify, and Modify DN operations, the server validates the following
naming constraints. Unless otherwise specified, the server returns LDAP error
namingViolation if a naming constraint is not met.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>o The RDN must not contain a
character with value 0xA.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>o The RDN must not contain a
character with value 0x0; otherwise, the server SHOULD return LDAP error
invalidDNSyntax. However, if the DC functional level is DS_BEHAVIOR_WIN2000,
the server will not return an error.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>o The DN must be compliant with
[RFC2253].<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>o The RDN size must be less than
255 characters.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Naming constraints are not
enforced for replicated updates.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>3.1.1.5.5 Delete Operation<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>...<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>In most cases, upon deletion, a
tombstone, deleted-object, or recycled-object is moved into the Deleted Objects
container of its NC; for exceptions see section 3.1.1.5.5.6. The RDN of the
object is changed to a "delete-mangled RDN"—an RDN that is guaranteed
to be unique within the Deleted Objects container. If O is the object that is
deleted, the delete-mangled RDN is the concatenation of O!name, the character
with value 0x0A, the string "DEL:", and the dashed string
representation ([RFC4122] section 3) of O!objectGUID. A "delete-mangled
DN" is a DN such that the leaf RDN is a delete-mangled RDN.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>==============================================================================<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Question:<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>From: tridge@samba.org
[mailto:tridge@samba.org]<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Sent: Monday, November 09, 2009
6:58 PM<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>To: Hongwei Sun<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Cc: cifs-protocol@samba.org;
hyc@highlandsun.com<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Subject: RE: limits on rDN size
in AD ?<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Hi Hongwei,<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>We're back to the old question
of rDN size limits again!<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>I just got a DRS replication
reply from w2k8-r2 with a CN that has a length larger than 64. So I suspect
that things are a bit more complex than what we'd discussed before.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>The object was:<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>
CN=89532b80-09fe-445e-afef-965c0d7f7d15\0ADEL:462902b4-1824-4f02-8956-9f934f64fa01,CN=Deleted
Objects,CN=Configuration,DC=vsofs8,DC=com<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>which gives a length of 80.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Are we perhaps supposed to
interpret the \0 as a termination character for the purposes of this length
constraint? (note that this is a \ followed by a 0, not a nul byte).<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Or perhaps deleted objects are
special in their constraints in some way?<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Cheers, Tridge<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>Regards,</span></b><span style='color:navy'><br>
</span><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>Bill Wesse</span></b><span style='color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>MCSE, MCTS / Senior Escalation Engineer, US-CSS DSC PROTOCOL
TEAM</span><span style='color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>8055 Microsoft Way</span><span style='color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>Charlotte, NC 28273</span><span style='color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Courier New";color:black'>TEL:
+1(980) 776-8200<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New";
color:black'>CELL: +1(704) 661-5438</span><span style='font-family:"Courier New";
color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Courier New";color:black'>FAX:
+1(704) 665-9606<o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Bill Wesse <br>
<b>Sent:</b> Thursday, November 12, 2009 9:44 AM<br>
<b>To:</b> 'tridge@samba.org'<br>
<b>Cc:</b> 'cifs-protocol@samba.org'; 'hyc@highlandsun.com'<br>
<b>Subject:</b> Re: limits on rDN size in AD (SRX091112600056 [MS-ADTS] limits
on rDN size in AD)<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Good morning Tridge! Since Hongwei is out of the office, I
have created case SRX091112600056 to track our work against your question about
rDN size / deleted object rDN.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I expect to be able to begin work on this tomorrow, and will
keep you updated!<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>Regards,</span></b><span style='color:navy'><br>
</span><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>Bill Wesse</span></b><span style='color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>MCSE, MCTS / Senior Escalation Engineer, US-CSS DSC PROTOCOL
TEAM</span><span style='color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>8055 Microsoft Way</span><span style='color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>Charlotte, NC 28273</span><span style='color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Courier New";color:black'>TEL:
+1(980) 776-8200<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New";
color:black'>CELL: +1(704) 661-5438</span><span style='font-family:"Courier New";
color:navy'><br>
</span><span style='font-size:10.0pt;font-family:"Courier New";color:black'>FAX:
+1(704) 665-9606<o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoPlainText>-----Original Message-----<o:p></o:p></p>
<p class=MsoPlainText>From: Hongwei Sun<o:p></o:p></p>
<p class=MsoPlainText>Sent: Thursday, November 12, 2009 12:56 PM<o:p></o:p></p>
<p class=MsoPlainText>To: 'tridge@samba.org'<o:p></o:p></p>
<p class=MsoPlainText>Cc: cifs-protocol@samba.org; hyc@highlandsun.com; Edgar
Olougouna; Sebastian Canevari<o:p></o:p></p>
<p class=MsoPlainText>Subject: RE: limits on rDN size in AD ?<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Tridge,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText> The RDN of Deleted Objects container is a little
different from the normal RDN. The following information in MS-ADTS
3.1.1.5.5 describes the composition of RDN for objects in Deleted Object
container:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText> "The RDN of the object is changed to a
"delete-mangled RDN"—an RDN that is guaranteed to be unique within
the Deleted Objects container. If O is the object that is deleted, the
delete-mangled RDN is the concatenation of O!name, the character with value
0x0A, the string "DEL:", and the dashed string representation
([RFC4122] section 3) of O!objectGUID."<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText> It looks like to me that for the Delete
Objects container, the size constraint should be dependent on the
combination of the each sub component. Since I am out of
office, I will ask one of my team member to investigate and confirm the
behavior.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Thanks !<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>-----Original Message-----<o:p></o:p></p>
<p class=MsoPlainText>From: tridge@samba.org [mailto:tridge@samba.org]<o:p></o:p></p>
<p class=MsoPlainText>Sent: Monday, November 09, 2009 6:58 PM<o:p></o:p></p>
<p class=MsoPlainText>To: Hongwei Sun<o:p></o:p></p>
<p class=MsoPlainText>Cc: cifs-protocol@samba.org; hyc@highlandsun.com<o:p></o:p></p>
<p class=MsoPlainText>Subject: RE: limits on rDN size in AD ?<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Hi Hongwei,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>We're back to the old question of rDN size limits again!<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>I just got a DRS replication reply from w2k8-r2 with a CN
that has a length larger than 64. So I suspect that things are a bit more
complex than what we'd discussed before.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>The object was:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>
CN=89532b80-09fe-445e-afef-965c0d7f7d15\0ADEL:462902b4-1824-4f02-8956-9f934f64fa01,CN=Deleted
Objects,CN=Configuration,DC=vsofs8,DC=com<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>which gives a length of 80.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Are we perhaps supposed to interpret the \0 as a
termination character for the purposes of this length constraint? (note that
this is a \ followed by a 0, not a nul byte).<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Or perhaps deleted objects are special in their
constraints in some way?<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Cheers, Tridge<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</body>
</html>