Fix finding members of AD groups

Previously UIDs weren't being looked up, as AD groups store the DN in the
member attribute of the group, which doesn't contain the login name or
attribute (typically it's the user's CN).  Now a search is done on the DN
and the login attribute returned from the entry.

(It only worked before when the CN equalled the username I think.)