direct group memberships (grp->mem) with memberOf