Allow to filter groups under a domain tree by CN.