title: LDAP extensible match filtering. Exclude groups base on OU text pattern
body: <p>I have an Active Directory root like:</p>
  
  <pre><code>dc=ooo,dc=yyy,dc=xx
  </code></pre>
  
  <p>under this root there are several OUs like:</p>
  
  <pre><code>ou=Applications,dc=ooo,dc=yyy,dc=xx
  ou=PKI,ou=Applications,dc=ooo,dc=yyy,dc=xx
  ou=Servers,dc=ooo,dc=yyy,dc=xx
  ou=Location1,ou=Servers,dc=ooo,dc=yyy,dc=xx
  ou=Department1,dc=ooo,dc=yyy,dc=xx
  ou=Subdepartment1=ou=Department1,dc=ooo,dc=yyy,dc=xx
  </code></pre>
  
  <p>I want to fetch all "departments", thus nodes which are represented as OUs, except specific OUs and their childs (based on OU term) which do not represent a department.</p>
  
  <p>For example in the case described above i would like to fetch only Department1 and its subdepartments. But i want to achieve this by excluding OU Application and its childs as also OU Servers and its childs (search based on excluding criteria)...</p>
  
  <p>I am performing the following search:</p>
  
  <pre><code>scope: subtree
  search dn clause: dc=ooo,dc=yyy,dc=xx (beggining from the root)
  filter: (&amp;(!(ObjectClass=person))(!(ou:dn:=Applications))(!(ou:dn:=Servers))
  </code></pre>
  
  <p>BUT the problem is that it only excludes 'Applications' and 'Servers' BUT not their children, so it returns me:</p>
  
  <pre><code>ou=PKI,ou=Applications,dc=ooo,dc=yyy,dc=xx
  ou=Location1,ou=Servers,dc=ooo,dc=yyy,dc=xx
  ou=Department1,dc=ooo,dc=yyy,dc=xx
  ou=Subdepartment1=ou=Department1,dc=ooo,dc=yyy,dc=xx
  </code></pre>
  
  <p>Anyway to eliminate all their childrens also? and to have finally only </p>
  
  <pre><code>ou=Department1,dc=ooo,dc=yyy,dc=xx
  ou=Subdepartment1=ou=Department1,dc=ooo,dc=yyy,dc=xx
  </code></pre>
  
  <p>returned??</p>