return
			}
			targetUser = requestorParentUser
		}
		targetGroups = requestorGroups

		// Deny if the target user is not LDAP
		foundResult, err := globalIAMSys.LDAPConfig.GetValidatedDNForUsername(targetUser)
		if err != nil {
			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
			return
		}
		if foundResult == nil {
			err := errors.New("Specified user does not exist on LDAP server")

		return nil, nil, errRet
	}

	groups, err := l.LDAP.SearchForUserGroups(conn, username, lookupRes.ActualDN)
	if err != nil {
		return nil, nil, err
	}

	return lookupRes, groups, nil
}

// GetValidatedDNForUsername checks if the given username exists in the LDAP directory.
// The given username could be just the short "login" username or the full DN.
//
// When the username/DN is found, the full DN returned by the **server** is