I'm running v3.5 and have basic LDAP authentication working.  Our LDAP main filter is mail which is the user's e-mail address.  I'd like to add a second filter to check to make sure that the account is active.  We have an attribute that if not equal 0 the account is active.  I've tried adding (!(maristpwwarning=0)) in the second LDAP filter, but it does not seem to be being respected.  If I try adding it to the main LDAP filter authentication fails for everyone.  Is anyone successfully using the second LDAP filter?  I'm not the LDAP guy so I won't be offended if you tell me there is a problem with my syntax.  Thanks in advance for any help you might be able to provide.
-John