Add integration test where we don't get groups back

internal/upstreamldap/upstreamldap.go

@@ -465,7 +465,6 @@ func (p *Provider) searchGroupsForUserDN(conn Conn, userDN string) ([]string, er
 	}
 
 	groups := []string{}
-entries:
 	for _, groupEntry := range searchResult.Entries {
 		if len(groupEntry.DN) == 0 {
 			return nil, fmt.Errorf(`searching for group memberships for user with DN %q resulted in search result without DN`, userDN)
@@ -476,7 +475,6 @@ entries:
 				return nil, fmt.Errorf("error finding groups for user %s: %w", userDN, err)
 			}
 			groups = append(groups, overrideGroupName)
-			continue entries
 		}
 		// if none of the overrides matched, use the default behavior (no mapping)
 		mappedGroupName, err := p.getSearchResultAttributeValue(groupAttributeName, groupEntry, userDN)