Confluence incorrectly fails AD connection tests when custom group DN is specified

I have configured the AD connector as on the screenshot attached specifying a custom group DN.
This always results in user membership test always failing. I have spent 3 hours troubleshooting this in vain, only to find out by accident that this actually works - looking at atlassian-confluence.log, the synchronisation succeeds and syncs the groups I expected. So this seems to be a bug
If I do not specify custom group DN, all tests pass.
Same behaviour is observed in JIRA(6.3.9)