The config file variable CN_STRING is overloaded as it
for both groups and users. This is a problem when the LDAP
server (for example) used uid for users but cn for
such a case, it is necessary to modify the config file
in order to
do group maintenance, and then remember to reset it
(else subsequent user maintenance will fail).
I contend that there should be two of these variables,
USER_CN_STRING and GROUP_CN_STRING.