This may not help you immediately because it appears to be something that was added in Mitaka but see the group_members_are_ids option in keystone.conf:
# If the members of the group objectclass are user IDs rather than DNs, set