What is a Distinguished Name?

A Distinguished Name (DN) is the unique, hierarchical identifier for a single entry in an LDAP directory tree or the subject field of an X.509 certificate. Built from an ordered sequence of relative components – such as common name, organizational unit, and domain component – a DN pinpoints exactly one object, unambiguously, within its directory or certificate namespace.

Key takeaways

• A DN uniquely identifies one entry in an LDAP directory or certificate.
• DNs are built from ordered components, such as CN, OU, and DC.
• The Bind DN and Base DN are two LDAP-specific uses of a DN.
• Versa appliances use a Bind DN to authenticate to directory servers.
• A DN’s uniqueness lets directories resolve exactly one matching object.

On this page: Why it matters · How it works · Types · DN & Versa · FAQ

Why is a DN important?

Every entry in an LDAP directory – a user, a group, a service account – needs an address that no other entry shares. A Distinguished Name is that address: a single string naming one object, unambiguously, anywhere in the tree. Without DNs, directories and the applications that query them have no reliable way to specify which object a request refers to.

DNs matter beyond directories, too. X.509 certificates carry a subject DN identifying who the certificate belongs to, and an issuer DN naming the certificate authority that signed it. Validating applications compare the subject DN, or a component like the Common Name, against the identity they expect.

For network and security teams, DNs are operational: an LDAP authentication profile is only as correct as the Bind DN and Base DN entered into it, and a mistyped DN is a common cause of failed directory authentication.

What is a DN?

A DN is a comma-separated sequence of relative distinguished names (RDNs), each an attribute=value pair. A typical LDAP DN looks like CN=jdoe,OU=Engineering,DC=example,DC=com: a user (CN=jdoe) inside an organizational unit inside a domain. Each RDN narrows the scope until exactly one entry remains.

Common attribute types include CN (Common Name), OU (Organizational Unit), O (Organization), DC (Domain Component), and C (Country). The same building blocks name X.509 certificate subjects and issuers, though certificates more often pair O and C with CN rather than the DC chain typical of Active Directory.

Two DNs recur in directory configuration: the Base DN, where a search begins, and the Bind DN, the identity a client authenticates as before it may search. Neither is optional – every LDAP query needs both.

Types of DNs

Not every DN plays the same role. Base DN sets the root of a directory search – everything below it is in scope, everything outside it is not. Bind DN identifies the account a client authenticates as; it is paired with a bind password and must resolve to a real directory entry with query permission. Subject DN, in X.509 certificates, names the entity the certificate was issued to. Issuer DN names the certificate authority that signed it.

A Relative Distinguished Name (RDN) is the smallest building block: one attribute=value pair, such as CN=jdoe. A full DN is an ordered chain of RDNs from the target entry up to the tree root. Administrators sometimes scope a Base DN to one organizational unit rather than the domain root, to limit what a profile can see.

DN & Versa

Versa’s SSE Gateway uses LDAP-based authentication profiles to validate users against Active Directory or Open-LDAP, and both the Base DN and Bind DN are required fields. The Bind DN is the service-account DN – for example cn=Administrator,cn=users,dc=versa,dc=com – the gateway uses to connect to and query the directory. The Base DN sets where in the directory tree lookups begin, commonly the domain root or one organizational unit.

Administrators typically retrieve both values from Active Directory with tools like dsquery – see the step-by-step configuration guide for the full procedure. Certificate-based profiles use DNs differently: the client certificate’s subject DN, often just its Common Name, is matched against the identity Versa expects.

Frequently asked questions

What is the difference between a Base DN and a Bind DN?

A Base DN sets the starting point for directory searches – the scope of the tree a query can see. A Bind DN is the account identity a client authenticates as before it may search. A profile needs both: the Bind DN to log in, the Base DN to know where to look.

What does a DN look like?

A DN is a comma-separated chain of attribute=value pairs, most specific first: CN=jdoe,OU=Engineering,DC=example,DC=com. Each segment is a relative distinguished name (RDN) that narrows the scope, from an individual entry down to the organizational unit and domain that contain it in the tree.

Is a DN the same as a Common Name?

No. A Common Name (CN) is one attribute within a DN – typically an entry’s display name or a certificate’s subject identity. The DN is the full path, combining the CN with other attributes like organizational unit and domain component to uniquely locate the entry.

Can two directory entries share the same DN?

No – uniqueness is the entire point of a DN. Directory servers enforce it: no two entries in the same tree can resolve to an identical Distinguished Name, which is what lets a DN serve as a reliable, unambiguous reference for authentication and lookups.

Why does an LDAP authentication profile need a DN at all?

Because LDAP has no other way to name a specific directory object. The Bind DN tells the server who is connecting; the Base DN tells it where to search. Without correct DNs, an authentication profile cannot locate the directory account it needs to validate.

More on Distinguished Names

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about DNs, these are worth looking at next.