return []string{}, err
	}

	// We map keys that correspond to LDAP DNs and validate that they exist in
	// the LDAP server.
	var dnValidator func(*libldap.Conn, string) (*ldap.DNSearchResult, bool, error) = sys.LDAPConfig.GetValidatedUserDN
	if isGroup {
		dnValidator = sys.LDAPConfig.GetValidatedGroupDN
	}

	// map of normalized DN keys to original keys.
	normalizedDNKeysMap := make(map[string][]string)