When you try to update an existing binding to an LDAP group, Tuleap tries to compute the differences between the current state of the group on the Tuleap side and the one in the directory so project administrators can force the synchronization if they want to. In order to find the group in the directory, we look for the common name. Unfortunately Tuleap retrieves the common name of the group using the CN attribute of the user instead of the one defined for the group.