Chapter 2. Configuring Directory Databases
2.1. Creating and Maintaining Suffixes

Figure 2.1. A Directory Tree with One Root Suffix
ou=people
suffix and all the entries and nodes below it might be stored in one database, the ou=groups
suffix in another database, and the ou=contractors
suffix in yet another database.
2.1.1. Creating Suffixes
2.1.1.1. Creating a Root Suffix
example.com
and one for redhat.com
. In this scenario, two root suffixes are required. One corresponding to the dc=example,dc=com
naming context and one corresponding to the dc=redhat,dc=com
naming context, as displayed in the following diagram:

Figure 2.2. A Directory with Two Root Suffixes
dc=example,dc=com
, and one root suffix corresponds to the European branch of their directory tree, l=europe,dc=example,dc=com
. From a client application's perspective, the directory tree looks as illustrated the following diagram:

Figure 2.3. A Directory with a Root Suffix Off Limits to Search Operations
dc=example,dc=com
branch of the directory will not return entries from the l=europe,dc=example,dc=com
branch of the directory, as it is a separate root suffix.
2.1.1.1.1. Creating a Root Suffix Using the Command Line
dsconf backend create
command to create a new root suffix:
- Optional: Identify the suffixes and back end databases that are already in use:
# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list dc=example,dc=com (userroot)
The name in parentheses is the back end database that stores the data of the corresponding suffix. You cannot use existing database names when you create the root suffix in the next step. - Create the
dc=example,dc=net
root suffix in theexample
back end database:# dsconf -D "cn=Directory Manager" ldap://server.example.com backend create \ --suffix="dc=example,dc=net" --be-name="example"
2.1.1.1.2. Creating a Root Suffix Using the Web Console
- Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
- Select the instance.
- Open themenu.
- Click.
- Enter the suffix DN and back end name. For example:
- Select
Create The Top Suffix Entry
. - Click.
2.1.1.2. Creating a Sub-suffix
l=europe,dc=example,dc=com
entry as a sub-suffix, this suffix is stored in a separate database. At the same time, the dc=example,com
root suffix and all its sub-entries - except l=europe,dc=example,dc=com
and subentries - are stored also in a separate database.

Figure 2.4. A Directory Tree with a Sub Suffix
2.1.1.2.1. Creating a Sub-suffix Using the Command Line
dsconf backend create
command to create a new sub-suffix. For example, to create the ou=People,dc=example,dc=com
sub-suffix in a new database called people
under the dc=example,dc=com
root suffix:
- Optional: Identify the suffixes and back end databases that are already in use:
# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list dc=example,dc=com (userroot)
The name in parentheses is the back end database that stores the data of the corresponding suffix. You cannot use existing database names when you create the sub-suffix in the next step. - Create the sub-suffix. For example, to create the
ou=People,dc=example,dc=com
sub-suffix along with theexample
back end database, enter:# dsconf -D "cn=Directory Manager" ldap://server.example.com backend create \ --suffix="ou=People,dc=example,dc=com" --be-name="example" \ --parent-suffix="dc=example,dc=com"
2.1.1.2.2. Creating a Sub-suffix Using the Web Console
- Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
- Select the instance.
- Open themenu.
- Select the suffix, under which you want to create the sub-suffix, click, and select .
- Enter the sub-suffix DN and back end name. For example:
- Select
Create The Top Sub-Suffix Entry
. - Click.
2.1.2. Maintaining Suffixes
2.1.2.1. Viewing the Default Naming Context
dc=example,dc=com
and a configuration suffix in cn=config
.
nsslapd-defaultnamingcontext
attribute in cn=config
. This value is propagated over to the root DSE (Directory Server Agent Service Entry) and can be queried by clients anonymously by checking the defaultnamingcontext
attribute in the root DSE:
# ldapsearch -p 389 -h server.example.com -x -b "" -s base | egrep namingcontext
namingContexts: dc=example,dc=com
namingContexts: dc=example,dc=net
namingContexts: dc=redhat,dc=com
defaultnamingcontext: dc=example,dc=com
Important
nsslapd-defaultnamingcontext
attribute from the nsslapd-allowed-to-delete-attrs
list.
nsslapd-defaultnamingcontext
attribute is included in the list of attributes which can be deleted, in the nsslapd-allowed-to-delete-attrs
attribute. This allows the current default suffix to be deleted and then update the server configuration accordingly.
nsslapd-defaultnamingcontext
attribute is removed from the list of configuration attributes which can be deleted, then no changes to that attribute are preserved. If the default suffix is deleted, that change cannot be propagated to the server configuration. This means that the nsslapd-defaultnamingcontext
attribute retains the old information instead of being blank (removed), which is the correct and current configuration.
2.1.2.2. Disabling a Suffix
2.1.2.2.1. Disabling a Suffix Using the Command Line
dsconf backend suffix set --disable
command. For example, to disable the o=test
suffix:
- Display the suffixes and their corresponding back end:
# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list dc=example,dc=com (userroot) o=test (test_database)
This command displays the name of the back end database next to each suffix. You require the suffix's database name in the next step. - Disable the suffix:
# dsconf -D "cn=Directory Manager" ldap://server.example.com backend \ suffix set --disable "test_database"
2.1.2.3. Deleting a Suffix
Warning
2.1.2.3.1. Deleting a Suffix Using the Command Line
dsconf backend delete
command. For example, to delete the o=test
suffix:
- Display the suffixes and their corresponding back end:
# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list dc=example,dc=com (userroot) o=test (test_database)
This command displays the name of the back end database next to each suffix. You require the suffix's database name in the next step. - Delete the back end database and the corresponding suffix:
# dsconf -D "cn=Directory Manager" ldap://server.example.com backend delete test_database Deleting Backend cn=test_database,cn=ldbm database,cn=plugins,cn=config : Type 'Yes I am sure' to continue: Yes I am sure The database, and any sub-suffixes, were successfully deleted
2.1.2.3.2. Deleting a Suffix Using the Web Console
- Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
- Select the instance.
- Open themenu.
- Select the suffix, click Delete Suffix., and select
- Clickto confirm.