#user object #distinguished name #dn #object linking #directory tree #identity linkage #group membership