[Exim] LDAP search scope

Hello,

I have a recipient verify local part that looks like this.....
${lookup ldap {user="cn=admin,dc=co,dc=com" \
pass=PASS ldap:///cn=${quote_ldap:$local_part},\
ou=${quote_ldap:$domain},dc=co,dc=com?cn?sub}} : \

The base dn is....
cn=username1,ou=domain,dc=co,dc=com
The are DNs below the base dn like this......
cn=group1,cn=username1,ou=domain,dc=co,dc=com

This verify fails because more than one cn is returned.

I have tried scope of one,base,sub. and ldapm but it always fails until
I delete the sub dn.

I'm fairly new to ldap and exim. Any ideas how this can work?

Thanks,
Craig