Scenario: Delegated Authentication Directory with "Copy Groups on Login"

When a user logs in, we do N+1 LDAP queries to check for this user's groups, where N = # of groups this user is in.

This group lookup pulls in all the attributes: This leads to a performance problem if N is very large or if each group has many members.

It isn't necessary for us to pull in the membership attributes: it's enough for us to check for mere presence of each group: the only attribute we need to return for this purpose is the groupname attribute.