LDAP source: filter by group membership