public List<Entry> getParentUserGroupEntries(ConnectedLDAPConfiguration config, Dn userDN)
            throws GuacamoleException {

        // Do not return any user groups if base DN is not specified
        Dn groupBaseDN = config.getGroupBaseDN();
        if (groupBaseDN == null)
            return Collections.emptyList();

        // memberAttribute specified in properties could contain DN or username 
        MemberAttributeType memberAttributeType = config.getMemberAttributeType();
        String userIDorDN = userDN.toString();
        Collection<String> userAttributes = config.getUsernameAttributes();
        if (memberAttributeType == MemberAttributeType.UID) {
            // Retrieve user objects with userDN
            List<Entry> userEntries = queryService.search(
                config,
                config.getLDAPConnection(),
                userDN,
                config.getUserSearchFilter(),
                0,
                userAttributes);
            // ... there can surely only be one
            if (userEntries.size() != 1)
                logger.warn("user DN \"{}\" does not return unique value "
                        + "and will be ignored", userDN.toString());
            else {
                // determine unique identifier for user
                Entry userEntry = userEntries.get(0);
                try {
                    userIDorDN = queryService.getIdentifier(userEntry,
                                         userAttributes);
                }
                catch (LdapInvalidAttributeValueException e) {
                    logger.error("User group missing identifier: {}",
                            e.getMessage());
                    logger.debug("LDAP exception while getting "
                            + "group identifier.", e);
                }
            }
        }

        // Gather all attributes relevant for a group
        String memberAttribute = config.getMemberAttribute();
        Collection<String> groupAttributes = new HashSet<>(config.getGroupNameAttributes());
        groupAttributes.add(memberAttribute);

        // Get all groups the user is a member of starting at the groupBaseDN,
        // excluding guacConfigGroups
        return queryService.search(
            config,
            config.getLDAPConnection(),
            groupBaseDN,
            getGroupSearchFilter(config),
            Collections.singleton(memberAttribute),
            userIDorDN,
            groupAttributes
        );

    }
Returns the LDAP entries representing all user groups that the given
user is a member of. Only user groups which are readable by the current
user will be retrieved.

@param config
    The configuration of the LDAP server being queried.

@param userDN
    The DN of the user whose group membership should be retrieved.

@return
    The LDAP entries representing all readable parent user groups of the
    user having the given DN.

@throws GuacamoleException
    If an error occurs preventing retrieval of user groups.
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/group/UserGroupService.java