Limiting directory searches

The ``Suffixes'' field is used to define the scope of client queries on a directory. For example, if a daemon has the suffix ``o=SCO, c=UK'', then the directory will only accept queries relating to the ``o=SCO, c=UK'' subtree. Executing a query via the ``Suffixes'' field is equivalent to the command line

ldapsearch -b "o=SCO, c=UK" "objectclass="

The -b option specifies the search base. See the ldapsearch(1ldap) manual page for details.

Attempting a query where no search base has been specified will cause the client to receive either a referral to another directory, or a failure.

An empty suffix will cause the directory to accept any queries. Note that if the client specifies a search base of ``o=SCO, c=UK'', then only entries within that sub-tree are returned.

A directory may have a range of suffixes to enable a client to query a number of sub-trees. However, only one sub-tree is searched at a time.

To add a suffix, select Suffixes Add then add the sub-tree name. If you wish to add an empty suffix, click on Add an empty suffix. Click on OK to commit the suffix specification.

To delete a suffix, select its entry in the scrollable ``Suffixes'' field, and select the Suffixes Delete menu option. Click on OK on the resulting confirmation prompt.

For information on how this is represented within the configuration file, see the suffix option in ``General backend options''.