Doesn't this assume that your members have DNs based on a CN, rather than say, a UID attr?