What are a Distinguished Name (DN) and a Relative Distinguished Name (RDN), and how is a DN built?

The RDN names an entry uniquely among its siblings; the DN is the RDN followed, comma-separated, by the DN of the parent, so it is the full path from the entry up to the root and names the entry uniquely in the whole directory.

Take this small tree:

dc=example
├── ou=users
│   ├── cn=John Doe
│   └── cn=Jane Smith
└── ou=groups
    └── cn=Admins

• The RDN of John's entry is cn=John Doe. It only has to be unique on its level: there can be another cn=John Doe under ou=groups, but not a second one under ou=users.
• His DN is cn=John Doe,ou=users,dc=example: his RDN, then the DN of the parent ou=users,dc=example.

A DN reads from the leaf up to the root, the opposite of a file path (/example/users/John Doe). It works like a postal address that goes from the person to the street, the town and the country.

Tip: The DN is the key of an entry. Moving or renaming an entry changes its DN (the modifyDN operation), which is why references to people are best kept in stable attributes such as a uid or a unique ID rather than in hard-coded DNs.

Go deeper:

• LDAP.com: LDAP DNs and RDNs — DN syntax, multi-valued RDNs and escaping of special characters.
• RFC 4514: String Representation of Distinguished Names — the exact rules for writing a DN as a string.