// Validate and normalize users, then fetch and normalize their groups
		// Also include unvalidated users for backward compatibility.
		for _, user := range q.Users {
			lookupRes, actualGroups, _ := sys.LDAPConfig.GetValidatedDNWithGroups(user)
			if lookupRes != nil {
				groupSet := set.CreateStringSet(actualGroups...)

				// duplicates can be overwritten, fetched groups should be identical.
				cleanQ.Users[lookupRes.NormDN] = groupSet