return wrapSRErr(errNoSuchGroup)
			}
			entityName = foundGroupDN.NormDN
		} else {
			var foundUserDN *xldap.DNSearchResult
			if foundUserDN, err = globalIAMSys.LDAPConfig.GetValidatedDNForUsername(entityName); err != nil {
				iamLogIf(ctx, err)
			} else if foundUserDN == nil {
				return wrapSRErr(errNoSuchUser)
			}
			entityName = foundUserDN.NormDN
		}
		if err != nil {