ldapsearch filter question