- Move department_id to department_dn resolution to ViewSet layer - update_user_in_ldap_only now receives ready department_dn parameter - LDAP service no longer queries Department.objects directly - All three *_in_ldap_only methods are now pure LDAP (no DB access)