In testing Estatio's LDAP integration, have found that the userId contains an '@' symbol. When this is marshalled into an OID (as part of the serialization of the version of the object) we get a runtime exception.
The original reason for excluding the '@' symbol was because of URI encoding concerns, eg if the OID appeared in a URI for the Restful Objects viewer. However, the value would only ever occur in the path part of the URI (if in the body or query string, then the RO spec defines base 64 encoding anyway).
As per http://www.ietf.org/rfc/rfc3986.txt (section 3.3), the path component may contain an '@' symbol.