Shouldn't we be looking up teams by DN, not by CN? We already have the DN in the team maps_to, why wouldn't we use that to query the group directly?