canonicalHeaders := buf.String()

	// Get signed headers.
	signedHeaders := strings.Join(headers, ";")

	// Get canonical query string.
	req.URL.RawQuery = strings.ReplaceAll(req.URL.Query().Encode(), "+", "%20")

	// Get canonical URI.
	canonicalURI := s3utils.EncodePath(req.URL.Path)

	// Get canonical request.
	// canonicalRequest =
	//  <HTTPMethod>\n
	//  <CanonicalURI>\n
	//  <CanonicalQueryString>\n

			} else if foundGroupDN == "" || !underBaseDN {
				err = errNoSuchGroup
				return
			}
			// We use the group DN returned by the LDAP server (this may not
			// equal the input group name, but we assume it is canonical).
			dn = foundGroupDN
		} else {
			dn = r.Group
		}
		isGroup = true
	}

	// Backward compatibility in detaching non-normalized DNs.
	if !isAttach {
		var oldDN string