Support the definition of arbitrary LDAP filters, where users matched are deemed to be part of a group, support dynamic groups where a group has an attribute which is an LDAP filter.