private ExprNode getConnectionSearchFilter(LDAPAuthenticatedUser user)
            throws LdapException, GuacamoleException {

        ConnectedLDAPConfiguration config = user.getLDAPConfiguration();
        Dn userDN = config.getBindDN();

        AndNode searchFilter = new AndNode();

        // Add the prefix to the search filter, prefix filter searches for guacConfigGroups with the userDN as the member attribute value
        searchFilter.addNode(new EqualityNode("objectClass", CONNECTION_LDAP_OBJECT_CLASS));
        
        // Apply group filters
        OrNode groupFilter = new OrNode();
        groupFilter.addNode(new EqualityNode(config.getMemberAttribute(),
            userDN.toString()));

        // Additionally filter by group membership if the current user is a
        // member of any user groups
        List<Entry> userGroups = userGroupService.getParentUserGroupEntries(config, userDN);
        if (!userGroups.isEmpty()) {
            userGroups.forEach(entry ->
                groupFilter.addNode(new EqualityNode(LDAP_ATTRIBUTE_NAME_GROUPS,entry.getDn().toString()))
            );
        }

        // Complete the search filter.
        searchFilter.addNode(groupFilter);

        return searchFilter;
    }
Returns an LDAP search filter which queries all connections accessible
by the given user.

@param user
    The AuthenticatedUser object associated with the user who is
    currently authenticated with Guacamole.

@return
    An LDAP search filter which queries all guacConfigGroup objects
    accessible by the user having the given DN.

@throws LdapException
    If an error occurs preventing retrieval of user groups.

@throws GuacamoleException
    If an error occurs retrieving the group base DN.
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/connection/ConnectionService.java