public Rdn[] findGroupRDN(String groupname, LdapName baseDN) throws Exception {
        Log.debug("Trying to find a groups's RDN based on their group name: '{}'. Field: '{}', Base DN: '{}' ...", usernameField, groupname, baseDN);

        DirContext ctx = null;
        try {
            ctx = getContext(baseDN);
            Log.debug("Starting LDAP search for group '{}'...", groupname);

            // Search for the dn based on the groupname.
            SearchControls constraints = new SearchControls();
            // If sub-tree searching is enabled (default is true) then search the entire tree.
            if (subTreeSearch) {
                constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
            }
            // Otherwise, only search a single level.
            else {
                constraints.setSearchScope(SearchControls.ONELEVEL_SCOPE);
            }
            constraints.setReturningAttributes(new String[] { groupNameField });

            String filter = MessageFormat.format(getGroupSearchFilter(), sanitizeSearchFilter(groupname));
            NamingEnumeration<SearchResult> answer = ctx.search("", filter, constraints);

            Log.debug("... search finished for group '{}'.", groupname);

            if (answer == null || !answer.hasMoreElements()) {
                Log.debug("Group DN based on groupname '{}' not found.", groupname);
                throw new GroupNotFoundException("Groupname " + groupname + " not found");
            }

            final SearchResult result = answer.next();
            final Rdn[] groupRDN = getRelativeDNFromResult(result );

            // Make sure there are no more search results. If there are, then
            // the groupname isn't unique on the LDAP server (a perfectly possible
            // scenario since only fully qualified dn's need to be unqiue).
            // There really isn't a way to handle this, so throw an exception.
            // The baseDN must be set correctly so that this doesn't happen.
            if (answer.hasMoreElements()) {
                Log.debug("Search for groupDN based on groupname '{}' found multiple responses, throwing exception.", groupname);
                throw new GroupNotFoundException("LDAP groupname lookup for " + groupname + " matched multiple entries.");
            }
            // Close the enumeration.
            answer.close();

            return groupRDN;
        } catch (final GroupNotFoundException e) {
            Log.trace("Group not found: '{}'", groupname, e);
            throw e;
        } catch (final Exception e) {
            Log.debug("Exception thrown when searching for groupDN based on groupname '{}'", groupname, e);
            throw e;
        }
        finally {
            try { if ( ctx != null ) { ctx.close(); } }
            catch (Exception e) {
                Log.debug("An unexpected exception occurred while closing the LDAP context after searching for group '{}'.", groupname, e);
            }
        }
    }
Finds a groups's dn using it's group name. Normally, this search will
be performed using the field "cn", but this can be changed by setting
the {@code groupNameField} property.<p>

Searches are performed over all subtrees relative to the {@code baseDN}.
If the search fails in the {@code baseDN} then another search will be
performed in the {@code alternateBaseDN}. For example, if the {@code baseDN}
is "o=jivesoftware, o=com" and we do a search for "managers", then we might
find a groupDN of "uid=managers,ou=Groups". This kind of searching is a good
thing since it doesn't make the assumption that all user records are stored
in a flat structure. However, it does add the requirement that "cn" field
(or the other field specified) must be unique over the entire subtree from
the {@code baseDN}. For example, it's entirely possible to create two dn's
in your LDAP directory with the same cn: "cn=managers,ou=Financial" and
"cn=managers,ou=Engineers". In such a case, it's not possible to
uniquely identify a group, so this method will throw an error.<p>

The dn that's returned is relative to the default {@code baseDN}.

@param groupname the groupname to lookup the dn for.
@param baseDN the base DN to use for this search.
@return the dn associated with {@code groupname}.
@throws Exception if the search for the dn fails.
@see #findGroupRDN(String) to search using the default baseDN and alternateBaseDN.
xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapManager.java