When querying a Samba Active Directory domain controller for the constructed attribute msDS-TokenGroupNames, the attribute is not returned. tokenGroups and tokenGroupsGlobalAndUniversal work as expected.