ldapsearch filter behaviour