return []string{}, err
	}

	// We map keys that correspond to LDAP DNs and validate that they exist in
	// the LDAP server.
	dnValidator := sys.LDAPConfig.GetValidatedUserDN
	if isGroup {
		dnValidator = sys.LDAPConfig.GetValidatedGroupDN
	}

	// map of normalized DN keys to original keys.
	normalizedDNKeysMap := make(map[string][]string)
	var collectedErrors []error