Instead of baking this into the groupfinder and passing it to execute, it would seem to be more consistent with the way the code is written already to make the attrlist an attribute of _LDAPQuery, and have ldap_set_login_query default to attrlist=None and have ldap_set_groups_query default to attrlist=() or so.  Eg.

    def ldap_set_groups_query(config, base_dn, filter_tmpl, scope=ldap.SCOPE_SUBTREE, cache_period=0, attrlist=()):
        query = _LDAPQuery(base_dn, filter_tmpl, scope, attrlist, cache_period)
        ....


    def ldap_set_login_query(config, base_dn, filter_tmpl, scope=ldap.SCOPE_SUBTREE, cache_period=0, attrlist=None):
        query = _LDAPQuery(base_dn, filter_tmpl, scope, attrlist, cache_period)
        ....

Then change _LDAPQuery to take into account the attrlist when executing/caching and within its __str__ method.