I haven't tried this on more than one LDAP source, so I assumed it would work, it certainly does in our LDAP system. Ideal solution might be to add another base_dn for groups but if it can be computed I'd just leave it as is.