A network engineer is integrating Cisco ISE with a third-party LDAP directory (OpenLDAP) to authenticate contractor accounts. During testing, users can be found and authenticated, but ISE cannot retrieve any group membership for authorization policy conditions. The engineer confirms the bind credentials are valid and the connection test succeeds. Which LDAP configuration element must be verified to resolve the missing group data?