if dur < minLDAPExpiry || dur > maxLDAPExpiry {
		return 0, auth.ErrInvalidDuration
	}
	return dur, nil
}

// ParsesAsDN determines if the given string could be a valid DN based on
// parsing alone.
func (l Config) ParsesAsDN(dn string) bool {
	_, err := ldap.ParseDN(dn)
	return err == nil
}

// IsLDAPUserDN determines if the given string could be a user DN from LDAP.

		}
		res, err := globalIAMSys.LDAPConfig.GetValidatedDNForUsername(user)
		if res == nil {
			err = errNoSuchUser
		}
		if err != nil {
			if validate {
				return "", err
			}
			if !globalIAMSys.LDAPConfig.ParsesAsDN(user) {
				return "", errNoSuchUser
			}
		}
		return res.NormDN, nil
	default:
		return "", errIAMActionNotAllowed
	}
}

		//
		// The target user may be supplied as a (short) username or a DN.
		// However, for now, we only support using the short username.

		isDN := globalIAMSys.LDAPConfig.ParsesAsDN(targetUser)
		opts.claims[ldapUserN] = targetUser // simple username
		var lookupResult *xldap.DNSearchResult
		lookupResult, targetGroups, err = globalIAMSys.LDAPConfig.LookupUserDN(targetUser)
		if err != nil {