rework ldap filtering