The ldap connector should have a filter setting to allow limiting the
search to known good objects

for example, we store people's multiple posix accounts as each of these
people's child objects, and each account object appears when searching for
that person.
it would be much easier to have a filter field that would be used when
searching (for example we would use "(objectClass=inetOrgPerson)" in our
setup to weed out all the "posixAccount" records)