I'm not very familiar with ldap, but are group common names guaranteed to be unique? If not, could this return users from multiple groups if multiple groups shared the same common name? Would it be better to use the group dn in the filter?