return
			} else if foundGroupDN == "" || !underBaseDN {
				err = errNoSuchGroup
				return
			}
			// We use the group DN returned by the LDAP server (this may not
			// equal the input group name, but we assume it is canonical).
			dn = foundGroupDN
		} else {
			dn = r.Group
		}
		isGroup = true
	}

	// Backward compatibility in detaching non-normalized DNs.
	if !isAttach {
		var oldDN string