Avoid over-using LDAP connections when decomposing groups