Chapter 2. Configuring Directory Databases
2.1. Creating and Maintaining Suffixes

Figure 2.1. A Directory Tree with One Root Suffix
ou=people
suffix and all the entries and nodes below it might be stored in one database, the ou=groups
suffix in another database, and the ou=contractors
suffix in yet another database.
2.1.1. Creating Suffixes
example.com
and one for redhat.com
. Here, two root suffixes are required, one corresponding to the dc=example,dc=com
naming context and one corresponding to the dc=redhat,dc=com
naming context, as shown in Figure 2.2, “A Directory Tree with Two Root Suffixes”.

Figure 2.2. A Directory Tree with Two Root Suffixes
dc=example,dc=com
, and one root suffix corresponds to the European branch of their directory tree, l=europe,dc=example,dc=com
. From a client application's perspective, the directory tree looks as illustrated in Figure 2.3, “A Directory Tree with a Root Suffix Off Limits to Search Operations”.

Figure 2.3. A Directory Tree with a Root Suffix Off Limits to Search Operations
dc=example,dc=com
branch of the directory will not return entries from the l=europe,dc=example,dc=com
branch of the directory, as it is a separate root suffix.
dc=example,dc=com
, and then create a sub suffix beneath it for the European directory entries, l=europe,dc=example,dc=com
. From a client application's perspective, the directory tree would appear as illustrated in Figure 2.4, “A Directory Tree with a Sub Suffix”.

Figure 2.4. A Directory Tree with a Sub Suffix
2.1.1.1. Creating a New Root Suffix Using the Console
- In the Directory Server Console, select the Configuration tab.
- Right-click Data in the left navigation pane, and select New Root Suffix from the pop-up menu.
- Enter a unique suffix in the New suffix field.The suffix must be named in line with
dc
naming conventions, such asdc=example,dc=com
. - Select the Create associated database automatically to create a database at the same time as the new root suffix, and enter a unique name for the new database in the Database name field, such as
example2
. The name can be a combination of alphanumeric characters, dashes (-
), and underscores (_
). No other characters are allowed.Deselect the check box to create a database for the new root suffix later. This option specifies a directory where the database will be created. The new root suffix will be disabled until a database is created.

2.1.1.2. Creating a New Sub Suffix Using the Console
- In the Directory Server Console, select the Configuration tab.
- Under the Data in the left navigation pane, select the suffix under which to add a new sub suffix. Right-click the suffix, and select New Sub Suffix from the pop-up menu.The Create new sub suffix dialog box is displayed.
- Enter a unique suffix name in the New suffix field. The suffix must be named in line with
dc
naming conventions, for exampleou=groups
.The root suffix is automatically added to the name. For example, if the sub suffixou=groups
is created under thedc=example,dc=com
suffix, the Console automatically names itou=groups,dc=example,dc=com
. - Select the Create associated database automatically check box to create a database at the same time as the new sub suffix, and enter a unique name for the new database in the Database name field, such as
example2
. The name can be a combination of alphanumeric characters, dashes (-
), and underscores (_
). No other characters are allowed.If the check box is not selected, than the database for the new sub suffix must be created later. The new sub suffix is disabled until a database is created.

2.1.1.3. Creating Root and Sub Suffixes using the Command Line
cn=mapping tree,cn=config
entry. Use the ldapmodify
utility to add new suffixes to the directory.
Creating a Root Suffix
dc=example,dc=com
root suffix:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn="dc=example,dc=com",cn=mapping tree,cn=config changetype: add cn: dc=example,dc=com objectclass: top objectclass: extensibleObject objectclass: nsMappingTree nsslapd-state: backend nsslapd-backend: UserData
Creating a Sub Suffix
nsslapd-parent-suffix
.
ou=groups
sub suffix under the dc=example,dc=com
root suffix:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x
dn: cn="ou=groups,dc=example,dc=com",cn=mapping tree,cn=config
changetype: add
cn: ou=groups,dc=example,dc=com
objectclass: top
objectclass: extensibleObject
objectclass: nsMappingTree
nsslapd-state: backend
nsslapd-backend: GroupData
nsslapd-parent-suffix: dc=example,dc=com
2.1.2. Maintaining Suffixes
2.1.2.1. Viewing the Default Naming Context
dc=example,dc=com
, a configuration suffix in cn=config
, and an administrative configuration suffix in o=netscaperoot
.
nsslapd-defaultnamingcontext
attribute in cn=config
. This value is propagated over to the root DSE (Directory Server Agent Service Entry) and can be queried by clients anonymously by checking the defaultnamingcontext
attribute in the root DSE:
# ldapsearch -p 389 -h server.example.com -x -b "" -s base | egrep namingcontext
namingContexts: dc=example,dc=com
namingContexts: dc=example,dc=net
namingContexts: dc=redhat,dc=com
defaultnamingcontext: dc=example,dc=com
Important
nsslapd-defaultnamingcontext
attribute from the nsslapd-allowed-to-delete-attrs
list.
nsslapd-defaultnamingcontext
attribute is included in the list of attributes which can be deleted, in the nsslapd-allowed-to-delete-attrs
attribute. This allows the current default suffix to be deleted and then update the server configuration accordingly.
nsslapd-defaultnamingcontext
attribute is removed from the list of configuration attributes which can be deleted, then no changes to that attribute are preserved. If the default suffix is deleted, that change cannot be propagated to the server configuration. This means that the nsslapd-defaultnamingcontext
attribute retains the old information instead of being blank (removed), which is the correct and current configuration.
2.1.2.2. Disabling a Suffix
2.1.2.2.1. Disabling a Suffix Using the Command Line
nsslapd-state
attribute of the corresponding suffix entry to disabled
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=suffix_DN,cn=mapping tree,cn=config changetype: modify replace: nsslapd-state nsslapd-state: disabled
2.1.2.2.2. Disabling a Suffix Using the Console
- In the Directory Server Console, select the Configuration tab.
- Under Data in the left navigation pane, click the suffix to disable.
- Click the Suffix Setting tab, and deselect the Enable this suffix check box.
2.1.2.3. Deleting a Suffix
Warning
2.1.2.3.1. Deleting a Suffix Using the Command Line
- Delete the suffix from the mapping tree:
# ldapdelete -D "cn=Directory Manager" -W -p 389 -h server.example.com -x "cn="suffix_DN",cn=mapping tree,cn=config"
- If the suffix uses a separate database, delete the database:
# ldapdelete -D "cn=Directory Manager" -W -p 389 -h server.example.com -x "cn=database_name,cn=ldbm database,cn=plugins,cn=config"
2.1.2.3.2. Deleting a Suffix Using the Console
- In the Directory Server Console, select the Configuration tab.
- Under Data in the left navigation pane, select the suffix to delete.
- Right-click the suffix, and select Delete from the menu.
- Select either Delete this suffix and all of its sub suffixes or Delete this suffix only.