clarifying ldap suffix options