Michael Ströder writes:
It really depends on what you want to express. Note that "" represents the rootDSE or root naming context. So "" would reference something existing or well-defined. IMHO NULL (or None in Python) would better signal something undefined or none-existing.
Yes. There is one case in the LDAP ASN.1 grammar (in rfc 4511) where you need to distinguish between an absent DN and an empty DN: The LDAPDN field ModifyDNRequest.newSuperior, which is 'OPTIONAL'. There may be others in LDAP extensions defined elsewhere.
OTOH the LDAPDN fields LDAPResult.matchedDN and BindRequest.name are usually treated as if they meant "absent DN". In those cases it may be better to return NULL, and/or treat NULL and "" as equivalent.
(For cases where a DN is not well-defined, I suppose an exception would be the normal way to handle that in Java. But I'm not a Java programmer.)