When a user authenticates to a MongoDB instance, they may not authenticate by presenting an LDAP DN which possesses groups. For example, when authenticating with Kerberos, the user will present a string containing their user principal name. MongoDB will need to have a mechanism which transforms the string that it has received into a representation which the LDAP server will recognize, when it is queried.