private ExprNode getGroupSearchFilter(LDAPConfiguration config) throws GuacamoleException {

        // Use filter defined by "ldap-group-search-filter" as basis for all
        // retrieval of user groups
        ExprNode groupFilter = config.getGroupSearchFilter();

        // Explicitly exclude guacConfigGroup object class only if it should
        // be assumed to be defined (query may fail due to no such object
        // class existing otherwise)
        if (config.getConfigurationBaseDN() != null) {
            groupFilter = new AndNode(
                groupFilter,
                new NotNode(new EqualityNode<String>("objectClass", "guacConfigGroup"))
            );
        }

        return groupFilter;
        
    }
Returns the base search filter which should be used to retrieve user
groups which do not represent Guacamole connections. As excluding the
guacConfigGroup object class may not work as expected if it is not
defined (may always return zero results), it should only be explicitly
excluded if it is expected to have been defined.

@param config
    The configuration of the LDAP server being queried.

@return
    The base search filter which should be used to retrieve user groups.

@throws GuacamoleException
    If guacamole.properties cannot be parsed.
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/group/UserGroupService.java