the ldap dn str dn seems to be what we are using in  keystone common ldap  dn to id so ldap dn str dn  cn   dumb   dc nonexistent cn  dumb  dc nonexistent ldap dn str dn  cn   dumb   dc nonexistent  dumb  you could use self assertnotequal keystone common ldap  dn to id conf ldap   dumb   member check assignment  user id 