Allow specification of an advanced LDAP filter on user import

[bpenris]

I have the following situation:

200K user objects in one OU who are all synced. Of these, only about 5500 are allowed to enroll in AAF. We have extended our eDirectory schema with the eduPerson class, with the attribute eduPersonAffilliation set to 'employee' in case they're entitled.

Furthermore, I need to exclude all accounts that have a specific status in another custom attribute called sccStatus.

So arbitrary LDAP filters are important. I understand that AA was originally AD-only and no one touches the AD-schema.

[TG920]

I agree, this is something that would be extremely helpful for license management as well. Scoping a high level OU with intermixed users who should be able to or not able to use the product is not feasible. Allowing a custom LDAP filter query would alleviate this.