diff --git a/main.go b/main.go
index fd0c279..2e4122d 100644
--- a/main.go
+++ b/main.go
@@ -294,7 +294,6 @@ func (server *Server) handleBind(s ldap.UserState, w ldap.ResponseWriter, m *lda
 }
 
 func (server *Server) handleBindInternal(state *State, r *message.BindRequest) (int, error) {
-
 	passwd, err := server.getAttribute(string(r.Name()), "userpassword")
 	if err != nil {
 		return ldap.LDAPResultOperationsError, err
@@ -328,7 +327,6 @@ func (server *Server) handleSearch(s ldap.UserState, w ldap.ResponseWriter, m *l
 }
 
 func (server *Server) handleSearchInternal(state *State, w ldap.ResponseWriter, r *message.SearchRequest) (int, error) {
-
 	log.Printf("-- SEARCH REQUEST: --")
 	log.Printf("Request BaseDn=%s", r.BaseObject())
 	log.Printf("Request Filter=%s", r.Filter())
@@ -481,19 +479,23 @@ func (server *Server) handleAddInternal(state *State, r *message.AddRequest) (in
 	}
 
 	// TODO check permissions
+
 	var members []string = nil
 
 	entry := Entry{}
 	for _, attribute := range r.Attributes() {
 		key := string(attribute.Type_())
-		if strings.EqualFold(key, "memberOf") {
-			return ldap.LDAPResultObjectClassViolation, fmt.Errorf(
-				"memberOf cannot be defined directly, membership must be specified in the group itself")
-		}
 		vals_str := []string{}
 		for _, val := range attribute.Vals() {
 			vals_str = append(vals_str, string(val))
 		}
+
+		// Fail if they are trying to write memberOf, we manage this ourselves
+		if strings.EqualFold(key, "memberOf") {
+			return ldap.LDAPResultObjectClassViolation, fmt.Errorf(
+				"memberOf cannot be defined directly, membership must be specified in the group itself")
+		}
+		// If they are writing a member key, we have to check they are adding valid members
 		if strings.EqualFold(key, "member") {
 			members = vals_str
 			for _, member := range members {
@@ -530,12 +532,24 @@ func (server *Server) handleAddInternal(state *State, r *message.AddRequest) (in
 				memberGroups = []string{}
 			}
 
-			memberGroups = append(memberGroups, dn)
-			err = server.addElements(member, Entry{
-				"memberOf": memberGroups,
-			})
-			if err != nil {
-				return ldap.LDAPResultOperationsError, err
+			alreadyMember := false
+			for _, mb := range memberGroups {
+				if mb == dn {
+					alreadyMember = true
+					log.Printf("Warning: inconsistency detected, %s was memberOf %s at a time when it didn't exist!",
+						member, dn)
+					break
+				}
+			}
+
+			if !alreadyMember {
+				memberGroups = append(memberGroups, dn)
+				err = server.addElements(member, Entry{
+					"memberOf": memberGroups,
+				})
+				if err != nil {
+					return ldap.LDAPResultOperationsError, err
+				}
 			}
 		}
 	}