ldap-filter diff