[SSSD] variable substitution in ldap_access_filter