nested group memberships (grp->mem) with memberOf