LDAP: demand a single search result, write to log otherwise