I understand code. I just think that you should add comment, that base_dn is default value for pwd or group, so you should remove it. It is not obvious from first look