If an administrator wishes to filter Openfire users by the group(s) of which they are a member, then the typical way this is done is to apply an ldap.searchFilter with a value similar to (|(memberOf=openfire-administrators)(memberOf=openfire-users))

If this is not possible (.e.g the memberOf attribute, or the equivalent, is not set as a user attribute) then it should be possible to filter Openfire users based on the Group membership instead (i.e. all users in the groups, rather than all users with a particular attribute set).