}
		if dnResult == nil {
			// dn not found - still attempt to detach if provided user is a DN.
			if !isAttach && sys.LDAPConfig.IsLDAPUserDN(r.User) {
				dn = sys.LDAPConfig.QuickNormalizeDN(r.User)
			} else {
				err = errNoSuchUser
				return updatedAt, addedOrRemoved, effectivePolicies, err
			}
		} else {
			dn = dnResult.NormDN
		}
		isGroup = false
	} else {