re: ldap group filter