I see that there are few reasonable options here: 1) IA5 strings precludes zero-length values 2) IA5 strings allows zero-length values 2A) a zero-length values only matches a zero-length value 2B) a zero-length value matches " " (and all values equivalent to " ").
I prefer 1 over 2A over 2B (see prior posts for why).
(Regardless of the choice LDAPprep can and should be designed to be idempotent.)
I prefer 1. I consider the fact that IA5String does not have the same size-restriction as DirectoryString a bug. Moreover allowing non-empty string is going to break clients en masse.
MVH leifj