Description of problem:

subsuffix are not returned in one level scoped search

Steps to reproduce the behavior:

• Create an instance with dc=example,dc=com suffix (with entries in the backends)
• Create a subsuffix just below the suffix with entries:
• dsconf instance backend create --suffix ou=foo,dc=example,dc=com --create-entries --be-name foo
• Run ldapsearch ldapsearch with sub scope:

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi://%2fvar%2frun%2fslapd-i1.socket -s sub -b dc=example,dc=com '(ou=*)' dn
(No errors: ou=foo,dc=example,dc=com is listed)

• Run ldapsearch with one scope:

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi://%2fvar%2frun%2fslapd-i1.socket -s one -b dc=example,dc=com '(ou=*)' dn
(Error: ou=foo,dc=example,dc=com is not listed)

Expected results

ou=foo,dc=example,dc=com should be listed in both cases

Additional context

This behavior confuses some ldap browsers that cannot show any more the entries below sub suffix.

Upstream ticket:

https://github.com/389ds/389-ds-base/issues/5772