Filtering LDAP entries on an OpenSolaris 2008.11 client

Configuring LDAP on an OpenSolaris system to talk to AD with SFU3.5 requires a command something like this:

ldapclient -v manual \
-a credentialLevel=self \
-a authenticationMethod=sasl/gssapi \
-a defaultSearchBase=dc=company,dc=com \
-a domainName=company.com \
-a defaultServerList="192.168.1.7 192.168.1.6" \
-a serviceSearchDescriptor=passwd:cn=Users,dc=company,dc=com?one \
-a serviceSearchDescriptor=group:cn=Users,dc=company,dc=com?one \
-a attributeMap=group:userpassword=msSFU30Password \
-a attributeMap=group:memberuid=msSFU30MemberUid \
-a attributeMap=group:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:gecos="displayName" \
-a attributeMap=passwd:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:uidnumber=msSFU30UidNumber \
-a attributeMap=passwd:uid=sAMAccountName \
-a attributeMap=passwd:homedirectory=msSFU30HomeDirectory \
-a attributeMap=passwd:loginshell=msSFU30LoginShell \
-a attributeMap=shadow:shadowflag=msSFU30ShadowFlag \
-a attributeMap=shadow:userpassword=msSFU30Password \
-a attributeMap=shadow:uid=sAMAccountName \
-a objectClassMap=group:posixGroup=group \
-a objectClassMap=passwd:posixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:cn=users,dc=company,dc=com?one \
-a serviceSearchDescriptor=group:cn=users,DC=company,DC=com?one