A lot of products from vendors actually try to make an assumption on the base layout of an
LDAP installation and configuration since they for the most part get configured the same
way over and over. If you were to setup 389ds by itself, yes,
ou=people,dc=ny,dc=example,dc=com would likely be valid. While FreeIPA does use 389ds, it
sets up its tree in a very specific manner.
Here's an example of what the base layout looks like (while also showing you how to
get this information using ldapsearch):
[label@ipa01 ~]$ kinit label
Password for label(a)EXAMPLE.NET:
[label@ipa01 ~]$ ldapsearch -LLLY GSSAPI -s one dn
SASL/GSSAPI authentication started
SASL username: label(a)EXAMPLE.NET
SASL SSF: 256
SASL data security layer installed.
dn: cn=compat,dc=example,dc=net
dn: ou=sudoers,dc=example,dc=net
dn: cn=accounts,dc=example,dc=net
dn: cn=alt,dc=example,dc=net
dn: cn=automount,dc=example,dc=net
dn: cn=hbac,dc=example,dc=net
dn: cn=sudo,dc=example,dc=net
dn: cn=etc,dc=example,dc=net
dn: cn=selinux,dc=example,dc=net
dn: cn=ca,dc=example,dc=net
dn: cn=pbac,dc=example,dc=net
dn: cn=kerberos,dc=example,dc=net
dn: ou=profile,dc=example,dc=net
dn: cn=provisioning,dc=example,dc=net
dn: cn=otp,dc=example,dc=net
dn: cn=radiusproxy,dc=example,dc=net
dn: cn=trusts,dc=example,dc=net
dn: cn=certmap,dc=example,dc=net
dn: cn=dns,dc=example,dc=net
All accounts live under cn=accounts by default. You'll end up seeing users, groups,
host groups, computer accounts down further.
[label@ipa01 ~]$ ldapsearch -LLLY GSSAPI -s one -b 'cn=accounts,dc=example,dc=net'
dn
SASL/GSSAPI authentication started
SASL username: label(a)EXAMPLE.NET
SASL SSF: 256
SASL data security layer installed.
dn: cn=users,cn=accounts,dc=example,dc=net
dn: cn=groups,cn=accounts,dc=example,dc=net
dn: cn=services,cn=accounts,dc=example,dc=net
dn: cn=computers,cn=accounts,dc=example,dc=net
dn: cn=hostgroups,cn=accounts,dc=example,dc=net
dn: cn=cosTemplates,cn=accounts,dc=example,dc=net
dn: cn=roles,cn=accounts,dc=example,dc=net
dn: cn=views,cn=accounts,dc=example,dc=net