Don't resolve user DN. You cannot retrieve the user information from the LDAP, including groups the user belongs to.