It seems like we're trying to support two separate base DNs by doing this, one for users (the existing base DN in the LDAP auth source) and another for groups (which goes back to the first dc= part).  Should we just add another base DN option to the auth source if this is required?