iamLogIf(ctx, err)
			} else if foundGroupDN == "" || !underBaseDN {
				err = errNoSuchGroup
			}
			entityName = foundGroupDN
		} else {
			var foundUserDN string
			if foundUserDN, err = globalIAMSys.LDAPConfig.GetValidatedDNForUsername(entityName); err != nil {
				iamLogIf(ctx, err)
			} else if foundUserDN == "" {
				err = errNoSuchUser