I see that there are few reasonable options here: 1) IA5 strings precludes zero-length values 2) IA5 strings allows zero-length values 2A) a zero-length values only matches a zero-length value 2B) a zero-length value matches " " (and all values equivalent to " "). I prefer 1 over 2A over 2B (see prior posts for why). (Regardless of the choice LDAPprep can and should be designed to be idempotent.)