Can’t log into OS X Server after restart

Found out that I couldn't use dscl in single user mode, or via the root account in a >console login. I'm not exactly sure why, but I did realize that the plists that dscl manipulates still had the right data except for one little value.

This thread pointed me in the right direction. I need to set the value of the Search Policy key to INT 3 (meaning Custom Search Policy) instead of INT 1 (the value I had set meaning Automatic):

defaults write '/Library/Preferences/DirectoryService/SearchNodeConfig' 'Search Policy' -int 3

I work with LDAP, but not that specific brand of server.

First thing I'd try is a search on users pulling all of their attributes instead of restricting it the way your example does.

ldapsearch -xLLL -H ldap://server.domain.net \
    -b "cn=users,dc=server,dc=domain,dc=net" uid=username1 \* +

Often there's a "memberOf" attribute on the user that lists the group name or group DN for groups that a user is in, kept in sync with the information in the group. If that's there, that is the easiest way to do what you want.

The * will grab all user attributes (the default behavior) and the + will grab all operational attributes (special attributes).