Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know an LDAP search base suffix generally matches the directory server's host name. In other words, I know if the host name is, I should use the search base suffix: dc=od,dc=foorbar,dc=com

It bothers me to not understand why I'm doing this. Could someone provide some background and explain precisely what I'm doing?

share|improve this question
I strongly disagree with the word "generally". Most LDAP sites use the delegated domain name (here NOT the server's hostname. – bortzmeyer May 26 '09 at 7:21
up vote 7 down vote accepted

Prior to Microsoft 'embracing, extending, and changing' LDAP, most implementations had objects to represent the root of the tree. I.e. You have to start from somewhere.

For reasons I am not completely clear on, in Active Directory, each Domain in the tree/forest is rooted with a name that dc=domain,dc=com that is not really two separate objects, rather it is a virtual root of the directory name space.

I think that some of it comes from the fact, that regardless of what is said about Active Directory, it is still a series of linked domains, and each domain needs to be treated as a standalone entity.

Now there are automatic transitive trusts within an AD tree, so that makes it matter less to end users, but even though the namespace looks kind of contiguous, it isn't really.

This becomes more evident with some of the naming rules with AD. For example sAMAccountName must be unique within a domain, regardless of whether they are in the same container or not. I.e. The full distinguished name must be unique, (you cannot have two John Smith users in the same container) but the shortname that is used for many things internally (sAMAccountName) needs to be unique within the entire domain.

Other directory services either have somewhat similar requirements, like uniqueID should really be unique within the entire directory, but that is more because applications usually make that assumption, as application writers have been too lazy to deal with the complex issue (I don't blame them, it is a hard problem) of how to handle two users with short names of jsmith trying to use a service, but existing in two different containers. (I.e. Perhaps cn=jsmith,ou=London,dc=acme,dc=com and cn=jsmith,ou=Texas,dc=acme,dc=com).

How should your application using this directory decide which user to use? The usual answer is let the user decide. But that means catching this case, presenting a UI to the user choose from and whatnot.

Most application writers just ignore that possibility and just use uniqueID or sAMAccountName because that is unique (sort of) and easier to do.

The difference between uniqueID and sAMAccountName would be that uniqueID should be unique throughout the directory name space. Whereas sAMAccountName is only guaranteed unique within the domain. If the AD tree has several domains, there is no guarentee there of uniqueness, between domains.

share|improve this answer
I'm not sure if this even answers the question. Either the question isn't worded very well or my head is spinning too much. – ThatGraemeGuy Jun 5 '09 at 9:48
I think the WHY is somewhat arbitrary. You have to start somewhere, and X.500 which LDAP is based on says, you have to have a root to your tree. (Else it topples over?) Is the question WHY start somewhere? Why start here specifically? – geoffc Jun 5 '09 at 17:45

Others have explained why using a domain name is a good idea (but is not mandatory). I just add that the question is wrong: having a base suffix based on the name of a machine is not recommended at all (for obvious reasons: what if you replace by ?). You typically only use the delegated domain name so, if you have, you use dc=example,dc=com.

share|improve this answer
+1 nice observation. Totally missed that one :D – Commander Keen May 26 '09 at 7:53

The root of the directory has to be set to something. It could be set to whatever you like. Setting it to the domain name is simply a useful convention that ensures your directory name space is unique.

share|improve this answer

Short version: Match your domain-name as a guarantee that the base path is unique.

Do it, and you won't look like a newb admin if your company merges with another one, and you need to merge systems :)

Ok, that was a very short version =)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.