err = errNoSuchGroup
			} else {
				entityName = foundGroupDN.NormDN
			}
		} else {
			var foundUserDN *xldap.DNSearchResult
			if foundUserDN, err = globalIAMSys.LDAPConfig.GetValidatedDNForUsername(entityName); err != nil {
				iamLogIf(ctx, err)
			} else if foundUserDN == nil {
				err = errNoSuchUser
			} else {
				entityName = foundUserDN.NormDN
			}
		}
		if err != nil {

		return updatedAt, addedOrRemoved, effectivePolicies, err
	}

	var dn string
	var dnResult *ldap.DNSearchResult
	var isGroup bool
	if r.User != "" {
		dnResult, err = sys.LDAPConfig.GetValidatedDNForUsername(r.User)
		if err != nil {
			iamLogIf(ctx, err)
			return updatedAt, addedOrRemoved, effectivePolicies, err
		}
		if dnResult == nil {