s3: change ldap filter to what really was intended