Don't we always have the DN in the team maps_to attributes? Not sure why we're looking up the group by CN to get the DN which we already have in the team