err = errServerNotInitialized
		return
	}

	var dn string
	var dnResult *ldap.DNSearchResult
	var isGroup bool
	if r.User != "" {
		dnResult, err = sys.LDAPConfig.GetValidatedDNForUsername(r.User)
		if err != nil {
			iamLogIf(ctx, err)
			return
		}
		if dnResult == nil {
			// dn not found - still attempt to detach if provided user is a DN.