LDAP: Defining an RFC 2247 Format Root or Suffix

The top entry in a LDAP DIT (Directory Information Tree) is, in the LDAP world, variously referred to as the root, the base or the suffix depending on the document, its author, day of the week or some other variable unknown to us.

The term Root DSE defines a kinda super root/suffix that defines all the DITs supported by the LDAP server (in the namingContexts operational attribute) as well as number of other operational objects.

There are multiple methods for defining the root or suffix.

This page defines an RFC 2247 (domain name) based method. For illustrative purposes it assumes the organization has a domain name of example.net which is transformed into a root DN (or suffix or base) of dc=example, dc= net.

Two methods are defined in the RFC, one uses the STRUCTURAL objectClass domain, however the commonest definition uses the AUXILLIARY objectClass dcObject with the STRUCTURAL objectclass organization which has a single MUST attribute of o (organizationName) - but organizationalUnit with a MUST attribute of ou will also work perfectly. The LDIF fragment to add the root or suffix is shown below:

## DEFINE DIT ROOT/BASE/SUFFIX ####
## uses RFC 2247 format with dcObject objectClass
## replace example and net as necessary below

## dcObject is an AUXILLIARY objectclass and MUST
## have a STRUCTURAL objectclass (organization in this case)
# this is an ENTRY sequence and is preceded by a BLANK line

dn: dc=example,dc=net
dc: example
description: Optional. An RFC 2247 root or suffix name. As much text as you want  
 to place in this line up to 32K. Continuation data for the line above must 
 have <CR> or <CR><LF> that is, ENTER works 
 on both Windows and *nix system - new line MUST begin with ONE SPACE
objectClass: dcObject
objectClass: organization
o: Example, Inc.

## DEFINE DIT ROOT/BASE/SUFFIX ####
## uses RFC 2247 format with domain objectClass
## replace example and net as necessary below

## domain is a STRUCTURAL objectclass
# this is an ENTRY sequence and is preceded by a BLANK line

dn: dc=example,dc=net
dc: example
description: Optional. An RFC 2247 root or suffix name. As much text as you want  
 to place in this line up to 32K. Continuation data for the line above must 
 have <CR> or <CR><LF> that is, ENTER works 
 on both Windows and *nix system - new line MUST begin with ONE SPACE
objectClass: domain
o: Example, Inc.

OpenLDAP's OLC (cn=config) would use olcSuffix = dc=example, dc=net in the appropriate olcDatabase entry (slapd.conf would use suffix "dc=example,dc=net" in the database section).

ApacheDS would use suffix="dc=example,dc=net" in the <partitions><jdbmPartition ...> section of the server.xml file.

Notes:

1. On its face this looks like a multi-RDN value but it creates a simgle entry with a DN of dc=example, dc=com. Most LDAP servers do not validate that the DN (RDN) of the entry is covered by attribute definitions within the entry.

2. If being used with multiple label ccTLD domain names, such as, example.net.br then the following fragment would be used:

   ## DEFINE DIT ROOT/BASE/SUFFIX ####
   ## uses RFC 2247 format
   ## replace example and com as necessary below
   ## or for experimentation leave as is
   
   ## dcObject is an AUXILLIARY objectclass and MUST
   ## have a STRUCTURAL objectclass (organization in this case)
   # this is an ENTRY sequence and is preceded by a BLANK line
   
   dn: dc=example,dc=net, dc=br
   dc: example
   description: Optional. An RFC 2247 root or suffix name. As much text as you want  
    to place in this line up to 32K. Continuation data for the line above must 
    have <CR> or <CR><LF> that is, ENTER works 
    on both Windows and *nix system - new line MUST begin with ONE SPACE
   objectClass: dcObject
   objectClass: organization
   o: Example, S.A.
   

   The corresponding entries in OpenLDAP's olcSuffix (or slapd.conf) and ApacheDS's server.xml would be suffix "dc=example,dc=net,dc=br".

Extending the DIT

Subsequent entries for dc=example,dc=net would be added as shown in the LDIF fragment below:

## FIRST Level hierarchy - people 
## uses mixed upper and lower case for objectclass
# this is an ENTRY sequence and is preceded by a BLANK line

dn: ou=people, dc=example,dc=net
ou: people
description: All people in organisation
objectclass: organizationalunit

## SECOND Level hierarchy
## ADD a single entry under FIRST (people) level
# this is an ENTRY sequence and is preceded by a BLANK line
# the ou: Human Resources is the department name

dn: cn=Robert Smith,ou=people, dc=example,dc=net
objectclass: inetOrgPerson
cn: Robert Smith
cn: Robert J Smith
cn: bob  smith
sn: smith
uid: rjsmith
userpassword: rJsmitH
carlicense: HISCAR 123

Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.