PAM PTA plugin can be configured for certain suffixes/subtrees using pamIncludeSuffix and pamExcludeSuffix. In documentation for PAM PTA, "subtrees" and "suffixes" are used as equivalents. In reality, we really can include/exclude not only different suffixes, but also subtrees, from PAM PTA. As reference see https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/pam-pta.html section 14.9.1.1. Specifying the Subtrees to Target for PAM PTA

However, this behavior is NOT consistent with how pamMissingSuffix works. PamMissingSuffix enables logging messages in case that pamIncludeSuffix/pamExcludeSuffix contains non-existing entry. In case when these attributes contain suffix, error messages are logged correctly. In case when these attributes contain subtree, not error message is logged.

Version-Release number of selected component (if applicable):
389-ds-base-1.2.11.15-2.el6.x86_64, however, 389-ds-base-1.2.10.2-15.el6.x86_64 was tested OK

Steps to Reproduce:
Assume we have suffix "dc=example,dc=com", which does NOT have subtree "cn=no_such_subtree, dc=example, dc=com".

1)
ldapmodify -h $IP -p $PORT -D "cn=directory manager" -w Secret123 <<EOF
dn: cn=PAM Pass Through Auth,cn=plugins,cn=config
changetype: modify
add: pamIncludeSuffix
pamIncludeSuffix: cn=no_such_subtree, dc=example, dc=com
EOF

2) restart server

3) cat /var/log/dirsrv/slapd-dstet/errors

Expected result:
Error message should be present in error log. From 1.2.10.2:

29 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - The following is the list of valid suffixes to use with pamExcludeSuffix and pamIncludeSuffix:
30 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - dc=brq,dc=redhat,dc=com
31 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - cn=schema
32 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - cn=monitor
33 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - cn=config
34 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - Error 53: The following suffixes listed in pamExcludeSuffix or pamIncludeSuffix are not present in this server: cn=nosuchsuffix,dc=example,dc=com

Actual results:
no error message is present

Additional info:
In newer version 1.2.11.15 error message does not contain specific entry, that causes problems. Particularly, if we include non-existent suffix, error log would contain

29 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - The following is the list of valid suffixes to use with pamExcludeSuffix and pamIncludeSuffix:
30 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - dc=brq,dc=redhat,dc=com
31 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - cn=schema
32 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - cn=monitor
33 [15/Oct/2012:17:25:03 +0200] pam_passthru-plugin - cn=config

but last line would be ommitted.