public String retrieveSingle(String attribute, String searchFilter, boolean failOnMultipleResults, LdapName baseDN) {
        LdapContext ctx = null;
        try {
            ctx = getContext(baseDN);

            SearchControls searchControls = new SearchControls();
            // See if recursive searching is enabled. Otherwise, only search one level.
            if (isSubTreeSearch()) {
                searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            }
            else {
                searchControls.setSearchScope(SearchControls.ONELEVEL_SCOPE);
            }
            searchControls.setReturningAttributes(attribute == null ? new String[0] : new String[]{attribute});

            NamingEnumeration<SearchResult> answer = ctx.search("", searchFilter, searchControls);
            if (answer == null || !answer.hasMoreElements()) {
                return null;
            }
            SearchResult searchResult = answer.next();
            String result = attribute == null
                ? new LdapName(searchResult.getName()).addAll(0, baseDN).toString() :
                (String) searchResult.getAttributes().get(attribute).get();
            if (answer.hasMoreElements()) {
                Log.debug("Search result for '{}' is not unique.", searchFilter);
                if (failOnMultipleResults)
                    throw new IllegalStateException("Search result for " + searchFilter + " is not unique.");
            }
            answer.close();
            return result;
        }
        catch (Exception e) {
            Log.error("Error while searching for single result of: {}", searchFilter, e);
            return null;
        }
        finally {
            try {
                if (ctx != null) {
                    ctx.close();
                }
            } catch (Exception ex) {
                Log.debug("An exception occurred while trying to close a LDAP context after trying to retrieve a single attribute element for {}.", attribute, ex);
            }
        }
    }
Generic routine for retrieving a single element from the LDAP server.  It's meant to be very
flexible so that just about any query for a single results can make use of it without having
to reimplement their own calls to LDAP.
<p>
The passed in filter string needs to be pre-prepared!  In other words, nothing will be changed
in the string before it is used as a string.

@param attribute             LDAP attribute to be pulled from each result and placed in the return results.
                             Typically pulled from this manager. Null means the absolute DN is returned.
@param searchFilter          Filter to use to perform the search.  Typically pulled from this manager.
@param failOnMultipleResults It true, an {@link IllegalStateException} will be thrown, if the
                             search result is not unique. If false, just the first result will be returned.
@param baseDN                DN where to start the search. Typically {@link #getBaseDN()} or {@link #getAlternateBaseDN()}.
@return A single string.
xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapManager.java