public Rdn[] findUserRDN(String username, LdapName baseDN) throws Exception {
        //Support for usernameSuffix
        username = username + usernameSuffix;
        Log.debug("Trying to find a user's RDN based on their username: '{}'. Field: '{}', Base DN: '{}' ...", username, usernameField, baseDN);
        DirContext ctx = null;
        try {
            ctx = getContext(baseDN);
            Log.debug("Starting LDAP search for username '{}'...", username);
            // Search for the dn based on the username.
            SearchControls constraints = new SearchControls();
            // If sub-tree searching is enabled (default is true) then search the entire tree.
            if (subTreeSearch) {
                constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
            }
            // Otherwise, only search a single level.
            else {
                constraints.setSearchScope(SearchControls.ONELEVEL_SCOPE);
            }
            constraints.setReturningAttributes(new String[] { usernameField });

            // NOTE: this assumes that the username has already been JID-unescaped
            NamingEnumeration<SearchResult> answer = ctx.search("", getSearchFilter(),
                    new String[] {sanitizeSearchFilter(username)},
                    constraints);

            Log.debug("... search finished for username '{}'.", username);

            if (answer == null || !answer.hasMoreElements()) {
                Log.debug("User DN based on username '{}' not found.", username);
                throw new UserNotFoundException("Username " + username + " not found");
            }

            final SearchResult result = answer.next();
            final Rdn[] userRDN = getRelativeDNFromResult(result);

            // Make sure there are no more search results. If there are, then
            // the username isn't unique on the LDAP server (a perfectly possible
            // scenario since only fully qualified dn's need to be unqiue).
            // There really isn't a way to handle this, so throw an exception.
            // The baseDN must be set correctly so that this doesn't happen.
            if (answer.hasMoreElements()) {
                Log.debug("Search for userDN based on username '{}' found multiple responses, throwing exception.", username);
                throw new UserNotFoundException("LDAP username lookup for " + username + " matched multiple entries.");
            }
            // Close the enumeration.
            answer.close();

            return userRDN;
        } catch (final UserNotFoundException e) {
            Log.trace("UserNotFoundException thrown when searching for username '{}'", username, e);
            throw e;
        } catch (final Exception e) {
            Log.debug("Exception thrown when searching for userDN based on username '{}'", username, e);
            throw e;
        }
        finally {
            try { if ( ctx != null ) { ctx.close(); } }
            catch (Exception e) {
                Log.debug("An unexpected exception occurred while closing the LDAP context after searching for user '{}'.", username, e);
            }
        }
    }
Finds a user's RDN using their username in the specified baseDN. Normally, this search
will be performed using the field "uid", but this can be changed by setting
the {@code usernameField} property.

Searches are performed over all sub-trees relative to the {@code baseDN} unless
sub-tree searching has been disabled. For example, if the {@code baseDN} is
"o=jivesoftware, o=com" and we do a search for "mtucker", then we might find a userDN of
"uid=mtucker,ou=People". This kind of searching is a good thing since
it doesn't make the assumption that all user records are stored in a flat
structure. However, it does add the requirement that "uid" field (or the
other field specified) must be unique over the entire subtree from the
{@code baseDN}. For example, it's entirely possible to create two dn's
in your LDAP directory with the same uid: "uid=mtucker,ou=People" and
"uid=mtucker,ou=Administrators". In such a case, it's not possible to
uniquely identify a user, so this method will throw an error.<p>

The RDN that's returned is relative to the {@code baseDN}.

@param username the username to lookup the dn for.
@param baseDN the base DN to use for this search.
@return the RDN associated with {@code username}.
@throws Exception if the search for the RDN fails.
@see #findUserRDN(String) to search using the default baseDN and alternateBaseDN.
xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapManager.java