Currently the plugin looks for the users in the full domain. It should be possible to create an optional field, like the ldap plugin does, in which we only look for users in a specific subset of groups. This should improve the lookup performance in cases where the tree is huge.