diff --git a/lib/filters/index.js b/lib/filters/index.js
index ab410ed..bcf5d36 100644
--- a/lib/filters/index.js
+++ b/lib/filters/index.js
@@ -115,8 +115,33 @@ function _buildFilterTree(expr) {
     tree.name = '';
     tree.value = '';
 
+
+    // This parses and enforces filter syntax, which is an AttributeDescription
+    // plus a filter operator, followed by (for ldapjs), anything.  Note
+    // that ldapjs additionally allows the '_' character in the AD, as many
+    // users rely on it, even though it's non-standard
+    //
+    // From 4.1.5 of RFC251
+    //
+    //  AttributeDescription ::= LDAPString
+    //
+    //  A value of AttributeDescription is based on the following BNF:
+    //
+    //    <AttributeDescription> ::= <AttributeType> [ ";" <options> ]
+    //
+    //    <options>  ::= <option> | <option> ";" <options>
+    //
+    //    <option>   ::= <opt-char> <opt-char>*
+    //
+    //    <opt-char> ::=  ASCII-equivalent letters, numbers and hyphen
+    //
+    // Examples of valid AttributeDescription:
+    //
+    //    cn
+    //    userCertificate;binary
+
     /* JSSTYLED */
-    if (!/[a-zA-Z0-9;\-]+[~><:]?=.+/.test(expr))
+    if (!/[a-zA-Z0-9;_\-]+[~><:]?=.+/.test(expr))
       throw new Error(expr + ' is invalid');
 
     if (expr.indexOf('~=') !== -1) {