always return singleton value of LDAP attribute