AuthLDAPSubGroupClass iterates over the cn=* for the parent group, but a filter could just be built with all the objectClass'es and do this on the server.