[389-users] LDAP filter - is this possible?