param: turn ldap idmap suffix into a generated function