This query is for when we do not have the DN yet.  When user runs the sync or pre-sync script with --groups "group1, group2, etc" the we use this query to look up DN by using the group names (aka CN)