Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am configuring the Debian package nsslib-ldap and am wondering about one of the configuration options. The config file I'm editing is called 'libnss-ldap.conf'. The line in question is:

nss_base_group ou=Group,dc=example,dc=com?one

I understand everything except the "?one". What does that do? I can tell that the rest of the command means "look for group information from this distinguished name".

share|improve this question
up vote 1 down vote accepted

This is a parameter describing the LDAP search scope and means that all relevant entries are one level below the base given.

It would find cn=groupname,ou=Group,dc=example,dc=com, but not cn=subgroup,ou=groupname,ou=Group,dc=example,dc=com.

share|improve this answer
Thanks SvenW, this mostly answers my question. After some more searching, I found on Wikipedia that the format for this is "ldap://host:port/DN?attributes?scope?filter?extensions". Why then is there "?one" instead of "??one" at the end. The "?one" is a scope parameter, is it not? Source:… – Dylan Klomparens Dec 11 '12 at 16:05
The exact query string is build from different parts in the config file. You'll notice it's missing the ldap://host:port part as well. This is set elsewhere. – Sven Dec 11 '12 at 16:08
Great. This explains everything. Thanks for your help! – Dylan Klomparens Dec 11 '12 at 16:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.