OpenDS Tips: Multiple suffixes with OpenDS

When installing OpenDS, you’re asked to define a Base DN (aka Suffix, aka Naming Context) for your directory instance. A default is proposed : dc=example,dc=com.

OpenDS supports multiple suffixes per backend and multiple backends.

The Control Panel allows you to easily add suffixes to the current backend or to a new backend.

OpenDS Control Panel: New Suffix

You can also do it through the dsconfig command line tool.

$ dsconfig set-backend-prop --backend-name userRoot --add base-dn:dc=MyCompany,dc=com
--hostname localhost --port 4444 --bindDN cn=Directory\ Manager --bindPassword ********
--trustAll --noPropertiesFile --no-prompt
Technorati Tags: , , , 

7 thoughts on “OpenDS Tips: Multiple suffixes with OpenDS

  1. narendra 30 August 2012 / 07:57

    Hi Ludo,

    I am also trying the create the base dn in opendj ldap using the jndi and java. I am getting the error as

    he provided entry dc=test,dc=dom cannot be added because its suffix is not defined as one of the suffixes within the Directory Server]; remaining name ‘dc=test,dc=dom’

    Can you please let me know whether i am doing the error.

    Thansk in advance.

    • Ludo 30 August 2012 / 09:14

      A backend must be configured to host the suffix first. This is done with the command above in the post. Once this is done, you can create the entry “dc=test,dc=com”.
      The command above (dsconfig set-backend-prop …) can be also translated into LDAP operation(s) using JNDI, but I would not recommend it as it might change from version to version.

      • narendra 30 August 2012 / 09:36

        Thanks for the information i have tried using the command which you have mentioned .. what i was doing is that through java class i am just first logged in into the LDAP server and then executing this command … But i want to do the same thing in JNDI .. which i am not able to do so … As you have mentioned can you please let me know the LDAP operation using JNDI … i am doing as the POC for the same….

        Thanks for your quick response on the same…


      • narendra 31 August 2012 / 06:33

        Addition to that i am pasting my code … If you find the problem in the code then please let me know…

        public static String ldapUri = “ldap://”;
        public static String admindn = “cn=Directory Manager”;
        public static String admincred = “redhat”;

        public static void main(String args[]){
        Hashtable env = new Hashtable();
        env.put(Context.PROVIDER_URL, ldapUri);
        env.put( Context.SECURITY_PRINCIPAL, admindn );
        env.put( Context.SECURITY_CREDENTIALS, admincred );
        try {
        DirContext ctx = new InitialDirContext(env);

        Attributes attrs = new BasicAttributes(true);
        Attribute objclass = new BasicAttribute(“objectclass”);

        The error is am getting is
        javax.naming.NameNotFoundException: [LDAP: error code 32 – The provided entry dc=naren1,dc=naren1 cannot be added because its suffix is not defined as one of the suffixes within the Directory Server]; remaining name ‘dc=naren1,dc=naren1’
        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(

      • Ludo 31 August 2012 / 10:39


        Your code shows a misunderstanding of JNDI and LDAP. Although it’s displayed like an attribute in LDIF, “dn” is not an attribute in LDAP, it’s the Name of the entry, and for JNDI it’s the DirContext. When building the initial context, you should specify the DN of the userRoot backend config entry : ”ds-cfg-backend-id=userRoot,cn=Backends,cn=config”.
        Then you can create a sub Context as “dc=Narent1” (and only one level done the DirContext).
        Please check JDNI tutorial section about adding entries with LDAP.

        Kind regards,


  2. Ranjini 25 August 2016 / 15:53

    Hi Ludo , The above command worked for me . Inspite of that , I’m not able to rebuild indexes on my setup . I always see the error :
    ERROR: The server rejected the task for the following reason: The provided entry ds-task-id=20160825091739411,cn=Scheduled Tasks,cn=Tasks cannot be added because its suffix is not defined as one of the suffixes within the Directory Server

    Please suggest a way out .

    Thanks in advance !

    • Ludo 25 August 2016 / 16:10

      I would like to help you, but without complete details of the configuration, the command you run with its parameters and the detailed logs from the server, I’m afraid it’s going to be difficult. My first feeling is that the rebuild index command has a parameter that is incorrect or a typo (like the -b argument).
      Nevertheless, I’m not sure a blog is the right place to get help with commands and deployments. I suggest that you post your question and details through the OpenDJ Discussion Forum: or through ForgeRock support if you are a ForgeRock customer.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s