param: turn ldap user suffix into a generated function