param: turn ldap group suffix into a generated function