LDAP search filter on superior/parent attribute