Thanks to Doug Nazar and Urban Lindberg who pointed out that my real error was to have multiple rootdn's. Multiple suffixes are OK.