Can you add support for LDAP filers when configuring groups/roles/users on an LDAP. Right now I can only set up the root of the tree for each of groups/roles/users but I should be able to also filter the entries found as children of the selected root. This should be a easy addition since you are already filtering by objectClass.