dn needs to be fetched to be able to detect memberOf support