[389-users] determining dynamic group membership