code: @Nullable
      private String normalizedDn(String dn) {
          if (isNullOrEmpty(dn)) {
              return dn;
          } else {
              try {
                  return new Dn(dn).getNormName();
              } catch (LdapInvalidDnException e) {
                  LOG.debug("Invalid DN", e);
                  return dn;
              }
          }
      }
docs: When the given string is a DN, the method ensures that the DN gets normalized so it can be used in string
  comparison.
  
  If the string is not a DN, the method just returns it.
  
  Examples:
  
  String is a DN:
  input  = "cn=John Doe, ou=groups, ou=system"
  output = "cn=John Doe,ou=groups,ou=system"
  
  String is not a DN:
  input  = "john"
  output = "john"
  
  This behavior is needed because for some values we don't know if the value is a DN or not. (i.e. group member values)
  
  See: https://github.com/Graylog2/graylog2-server/issues/1790
  
  @param dn denormalized DN string
  @return normalized DN string