public function createLDAPGroup(Group $group) {
        if (!$this->enabled()) {
            return;
        }
        if (empty($group->Title)) {
            throw new ValidationException('Group missing Title. Cannot create LDAP group');
        }
        if (!$this->config()->new_groups_dn) {
            throw new Exception('LDAPService::new_groups_dn must be configured to create LDAP groups');
        }

        // LDAP isn't really meant to distinguish between a Title and Code. Squash them.
        $group->Code = $group->Title;

        $dn = sprintf('CN=%s,%s', $group->Title, $this->config()->new_groups_dn);
        try {
            $this->add($dn, [
                'objectclass' => 'group',
                'cn' => $group->Title,
                'name' => $group->Title,
                'samaccountname' => $group->Title,
                'description' => $group->Description,
                'distinguishedname' => $dn
            ]);
        } catch (\Exception $e) {
            throw new \ValidationException('LDAP group creation failure: ' . $e->getMessage());
        }

        $data = $this->getGroupByDN($dn);
        if (empty($data['objectguid'])) {
            throw new \ValidationException(
                new \ValidationResult(
                    false,
                    'LDAP group creation failure: group might have been created in LDAP. GUID is missing.'
                )
            );
        }

        // Creation was successful, mark the group as LDAP managed by setting the GUID.
        $group->GUID = $data['objectguid'];
        $group->DN = $data['dn'];
    }