GUACAMOLE-996: Document "ldap-group-search-filter" property and corresponding Docker environment variable.
diff --git a/src/guacamole-docker.md b/src/guacamole-docker.md
index 7ca4be4..30b9db3 100644
--- a/src/guacamole-docker.md
+++ b/src/guacamole-docker.md
@@ -592,6 +592,11 @@
this base DN. *If this variable is omitted, the seeAlso attribute will have
no effect on Guacamole configurations.*
+`LDAP_GROUP_SEARCH_FILTER`
+: The search filter used to query the LDAP tree for groups that may be used by
+ other extensions to define permissions. *If this property is omitted the
+ default of `(objectClass=*)` will be used.*
+
`LDAP_SEARCH_BIND_DN`
: The DN (Distinguished Name) of the user to bind as when authenticating users
that are attempting to log in. If specified, Guacamole will query the LDAP
diff --git a/src/ldap-auth.md b/src/ldap-auth.md
index d991e1a..1c509a3 100644
--- a/src/ldap-auth.md
+++ b/src/ldap-auth.md
@@ -416,6 +416,11 @@
your LDAP directory contains groups whose names are dictated by different
attributes, multiple attributes can be specified here, separated by commas.
+`ldap-group-search-filter`
+: The search filter used to query the LDAP tree for groups that may be used by
+ other extensions to define permissions. *If this property is omitted the
+ default of `(objectClass=*)` will be used.*
+
`ldap-dereference-aliases`
: Controls whether or not the LDAP connection follows (dereferences) aliases as
it searches the tree. Possible values for this property are "never" (the
