diff --git a/docs/content/en/reference/guides/ldap.md b/docs/content/en/reference/guides/ldap.md
index 1e581b23e..80a5eccb2 100644
--- a/docs/content/en/reference/guides/ldap.md
+++ b/docs/content/en/reference/guides/ldap.md
@@ -94,10 +94,10 @@ accounts. The active directory example has two attribute filters that accomplish
 be appreciated). The userAccountControl filter checks that the account is not disabled and the pwdLastSet makes sure that
 value is not 0 which means the password requires changing at the next login.
 
-| Implementation  |                                                                          Users Filter                                                                           |                         Groups Filter                         |
-|:---------------:|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------:|
-|     custom      |                                                                               N/A                                                                               |                              N/A                              |
-| activedirectory | (&(|({username_attribute}={input})({mail_attribute}={input}))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))) | (&(member={dn})(objectClass=group)(sAMAccountType=268435456)) |
+| Implementation  |                                                                          Users Filter                                                                           |               Groups Filter                |
+|:---------------:|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------------------------------------:|
+|     custom      |                                                                               N/A                                                                               |                    N/A                     |
+| activedirectory | (&(|({username_attribute}={input})({mail_attribute}={input}))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))) | (&(member={dn})(sAMAccountType=268435456)) |
 
 ##### Microsoft Active Directory sAMAccountType
 
diff --git a/internal/utils/const.go b/internal/utils/const.go
index 56686af64..1188b5f9c 100644
--- a/internal/utils/const.go
+++ b/internal/utils/const.go
@@ -141,7 +141,7 @@ const (
 
 	// CharSetRFC3986Unreserved are RFC3986 unreserved characters.
 	// See https://www.rfc-editor.org/rfc/rfc3986#section-2.3.
-	CharSetRFC3986Unreserved = CharSetAlphabetic + CharSetSymbolicRFC3986Unreserved
+	CharSetRFC3986Unreserved = CharSetAlphabetic + CharSetNumeric + CharSetSymbolicRFC3986Unreserved
 )
 
 var htmlEscaper = strings.NewReplacer(