The filter string to get all groups a user is in, including those reachable via nesting of those groups is: (&(objectClass=group)(member:1.2.840.113556.1.4.19 41:={0})) where the {0} value is the DN...