return l.GetValidatedDNUnderBaseDN(conn, userDN, l.LDAP.UserDNSearchBaseDistNames)
}

// GetValidatedGroupDN validates the given group DN. If conn is nil, creates a
// connection. The returned boolean is true iff the group DN is found under one
// of the configured LDAP base DNs.
func (l *Config) GetValidatedGroupDN(conn *ldap.Conn, groupDN string) (string, bool, error) {
	if conn == nil {
		var err error

		var normalizedGroups []string
		for _, group := range groups {
			// For a group, we store the normalized DN even if it not under a
			// configured base DN.
			validatedGroup, _, err := sys.LDAPConfig.GetValidatedGroupDN(conn, group)
			if err != nil {
				collectedErrors = append(collectedErrors, fmt.Errorf("could not validate `%s` exists in LDAP directory: %w", group, err))
				continue
			}
			if validatedGroup == "" {

		// form of the entityName (which will be an LDAP DN).
		var err error
		if isGroup {
			var foundGroupDN string
			var underBaseDN bool
			if foundGroupDN, underBaseDN, err = globalIAMSys.LDAPConfig.GetValidatedGroupDN(nil, entityName); err != nil {
				iamLogIf(ctx, err)
			} else if foundGroupDN == "" || !underBaseDN {
				err = errNoSuchGroup
			}
			entityName = foundGroupDN
		} else {

		// form of the entityName (which will be an LDAP DN).
		var err error
		if isGroup {
			var foundGroupDN string
			var underBaseDN bool
			if foundGroupDN, underBaseDN, err = globalIAMSys.LDAPConfig.GetValidatedGroupDN(nil, entityName); err != nil {
				iamLogIf(ctx, err)
			} else if foundGroupDN == "" || !underBaseDN {
				err = errNoSuchGroup
			}
			entityName = foundGroupDN
		} else {