During an upgrade, http.suffix is used to identify ldap entry when configuring kdc proxy. When the suffix is missing, the script crashed when enabling KDC proxy, because it used invalid DN. Fixes https://pagure.io/freeipa/issue/6920 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>