Index: component/src/webapp/WEB-INF/jldap-beans.xml
===================================================================
--- component/src/webapp/WEB-INF/jldap-beans.xml	(revision 57387)
+++ component/src/webapp/WEB-INF/jldap-beans.xml	(working copy)
@@ -96,6 +96,15 @@
 			<value>false</value>
 		</property>
 		
+		<!-- Optional. Control depth of all searches. Possible values:
+			0 - LDAPConnection.SCOPE_BASE - base object only
+			1 - LDAPConnection.SCOPE_ONE - immediate children of base object
+			2 - LDAPConnection.SCOPE_SUB - recursive 
+			Defaults to JLDAPDirectoryProvider.DEFAULT_SEARCH_SCOPE (2) -->
+		<!-- property name="searchScope">
+			<value>2</value>
+		</property -->
+		
 		<!-- Optional. Defaults to an instance of 
 		edu.amc.sakai.user.SimpleLdapConnectionManager -->
 		<!-- property name="ldapConnectionManager">
Index: jldap/src/java/edu/amc/sakai/user/JLDAPDirectoryProvider.java
===================================================================
--- jldap/src/java/edu/amc/sakai/user/JLDAPDirectoryProvider.java	(revision 57387)
+++ jldap/src/java/edu/amc/sakai/user/JLDAPDirectoryProvider.java	(working copy)
@@ -131,6 +131,11 @@
 	 * <code>LDAPConstraints.setTimeLimit(int)<code>.
 	 */
 	private int operationTimeout = DEFAULT_OPERATION_TIMEOUT_MILLIS;
+	
+	/** Default search scope for filters executed by 
+	 * {@link #searchDirectory(String, LDAPConnection, LdapEntryMapper, String[], String, int)}
+	 */
+	public static final int DEFAULT_SEARCH_SCOPE = LDAPConnection.SCOPE_SUB;
 
 	/** 
 	 * User entry attribute mappings. Keys are logical attr names,
@@ -178,6 +183,8 @@
 	};
 
 	private boolean caseSensitiveCacheKeys = DEFAULT_CASE_SENSITIVE_CACHE_KEYS;
+	
+	private int searchScope = DEFAULT_SEARCH_SCOPE;
 
 	public JLDAPDirectoryProvider() {
 		if ( M_log.isDebugEnabled() ) {
@@ -819,12 +826,13 @@
 						searchBaseDn + "][filter = " + filter + 
 						"][return attribs = " + 
 						Arrays.toString(searchResultPhysicalAttributeNames) + 
-						"][max results = " + maxResults + "]");
+						"][max results = " + maxResults + "]" +
+						"][search scope = " + searchScope + "]");
 			}
 
 			LDAPSearchResults searchResults = 
 				conn.search(searchBaseDn, 
-						LDAPConnection.SCOPE_SUB, 
+						searchScope, 
 						filter, 
 						searchResultPhysicalAttributeNames, 
 						false, 
@@ -1336,5 +1344,37 @@
 	public boolean isCaseSensitiveCacheKeys() {
 		return caseSensitiveCacheKeys;
 	}
+	
+	/**
+	 * Access the configured search scope for all filters executed by
+	 * {@link #searchDirectory(String, LDAPConnection, LdapEntryMapper, String[], String, int)}. 
+	 * int value corresponds to a constant in {@link LDAPConnection}:
+	 * SCOPE_BASE = 0, SCOPE_ONE = 1, SCOPE_SUB = 2. Defaults to
+	 * {@link #DEFAULT_SEARCH_SCOPE}.
+	 * 
+	 */
+	public int getSearchScope() {
+		return searchScope;
+	}
 
+	/**
+	 * Set the configured search scope for all filters executed by
+	 * {@link #searchDirectory(String, LDAPConnection, LdapEntryMapper, String[], String, int)}.
+	 * Validated
+	 * 
+	 * @param searchScope
+	 * @throws IllegalArgumentException if given scope value is invalid
+	 */
+	public void setSearchScope(int searchScope) throws IllegalArgumentException {
+		switch ( searchScope ) {
+			case LDAPConnection.SCOPE_BASE :
+			case LDAPConnection.SCOPE_ONE :
+			case LDAPConnection.SCOPE_SUB :
+				this.searchScope = searchScope;
+				return;
+			default :
+				throw new IllegalArgumentException("Invalid search scope [" + searchScope +"]");
+		}
+	}
+
 }
\ No newline at end of file