For LDAP sync, nested groups must fall within the configured
`group_base`. A customer recently ran in to this issue. It's
not immediately obvious but at least we can make a note in the
documentation.