[LDAP Realm] question about group-search-filter