Suffix configuration

Edit online

To create a directory hierarchy, you must configure the required suffix for your directory server instance.

A suffix is also known as a naming context. It has a distinguished name (DN) that identifies the top entry in a directory hierarchy. LDAP uses the relative naming scheme. Therefore, its DN is also the suffix for all entries in a directory hierarchy. In a directory server, you can add multiple suffixes, each identifying a directory hierarchy. When you add a suffix, the entry is added in the configuration file of a directory server instance. The following example shows a suffix entry, o=sample.

You can use Configuration Tool to add or remove suffixes. You can also use the idscfgsuf command to add suffixes and the idsucfgsuf command to remove suffixes. You must stop the directory server before you add or remove a suffix. For more information about the idscfgsuf or idsucfgsuf command, see Command Reference.

You cannot remove the system defined suffixes from a directory server instance. These suffixes are not available in a proxy server instances. The following suffixes are defined by system:

  • cn=localhost
  • cn=configuration
  • cn=ibmpolicies
  • cn=Deleted Objects

When you add entries to a directory server, you must consider the following points:

  • You must add a suffix entry in a directory server for a suffix DN.
  • An entry DN that you add to a directory server must contain a suffix that match the suffix DN value. The following example shows an entry with a suffix DN, ou=Marketing,o=sample.
  • You cannot add an entry on a proxy server instance or a directory server that is not configured with a DB2® database.

If a query contains a suffix that does not match any suffix that are configured for the local database, the query is referred to the LDAP server that is identified by the default referral. If no LDAP default referral is specified, the following message is generated: Object does not exist.