Appendix A - LDAP: Defining a Simple Root or Suffix

The top entry in a LDAP DIT (Directory Information Tree) is, in the LDAP world, variously referred to as the root, the base or the suffix depending on the document, its author, day of the week or some other variable unknown to us.

The term Root DSE defines a kinda super root/suffix that defines all the DITs supported by the LDAP server (in the namingContexts operational attribute) as well as number of other operational objects.

There are multiple methods for defining the root or suffix.

This page defines an ou based method, which is the simplest (and usually shortest) and will satisfy all the required criteria.

The definition will use the structural objectClass organizationalUnit which has a single MUST attrribute of ou (organizationalUnitName). The LDIF definition to add the root or suffix is shown below:

## DEFINE DIT ROOT/BASE/SUFFIX ####
## uses simple ou format
## replace root name with any appropriate text
## such as my, gobbledegook, suffix, whatever

## organizationalUnit is an STRUCTURAL objectclass and 
#  requires only an ou (organizationalUnitName) attribute
# this is an ENTRY sequence and is preceded by a BLANK line

dn: ou=root
ou: root
objectclass: organizationalUnit
description: Optional. A trivial root or suffix name. As much text as you want  
 to place in this line up to 32K. Continuation data for the line above must 
 have <CR> or <CR><LF> that is, ENTER works 
 on both Windows and *nix system - new line MUST begin with ONE SPACE

OpenLDAP's slapd.conf would have a definition of suffix "ou=root" in the database section (or olcSuffix if cn=config is being used).

ApacheDS would use suffix="root" in the <partitions><jdbmPartition ...> section of the server.xml file.

Subsequent entries would be added as shown in the LDIF fragment below:

## FIRST Level hierarchy - people 
## uses mixed upper and lower case for objectclass
# this is an ENTRY sequence and is preceded by a BLANK line

dn: ou=people, ou=root
ou: people
description: All people in organisation
objectclass: organizationalunit

## SECOND Level hierarchy
## ADD a single entry under FIRST (people) level
# this is an ENTRY sequence and is preceded by a BLANK line
# the ou: Human Resources is the department name

dn: cn=Robert Smith,ou=people,ou=root
objectclass: inetOrgPerson
cn: Robert Smith
cn: Robert J Smith
cn: bob  smith
sn: smith
uid: rjsmith
userpassword: rJsmitH
carlicense: HISCAR 123