We can search group folder with an empty string.

We'll add a  pluggable authentication utility:

  >>> print http(r"""
  ... POST /++etc++site/default/@@contents.html HTTP/1.1
  ... Authorization: Basic mgr:mgrpw
  ... Content-Type: application/x-www-form-urlencoded
  ... 
  ... type_name=BrowserAdd__zope.app.authentication.authentication.LocalPluggableAuthentication&new_value=PA""")
  HTTP/1.1 303 See Other
  ...

And register it:

  >>> print http(r"""
  ... POST /++etc++site/default/PA/addRegistration.html HTTP/1.1
  ... Authorization: Basic mgr:mgrpw
  ... Content-Type: multipart/form-data; boundary=---------------------------8474411127918531132143183931
  ... Referer: http://localhost:8081/++etc++site/default/PA/addRegistration.html
  ... 
  ... -----------------------------8474411127918531132143183931
  ... Content-Disposition: form-data; name="field.name"
  ... 
  ... 
  ... -----------------------------8474411127918531132143183931
  ... Content-Disposition: form-data; name="field.provided"
  ... 
  ... zope.app.security.interfaces.IAuthentication
  ... -----------------------------8474411127918531132143183931
  ... Content-Disposition: form-data; name="field.provided-empty-marker"
  ... 
  ... 1
  ... -----------------------------8474411127918531132143183931
  ... Content-Disposition: form-data; name="field.status"
  ... 
  ... Active
  ... -----------------------------8474411127918531132143183931
  ... Content-Disposition: form-data; name="field.permission"
  ... 
  ... 
  ... -----------------------------8474411127918531132143183931
  ... Content-Disposition: form-data; name="field.permission-empty-marker"
  ... 
  ... 1
  ... -----------------------------8474411127918531132143183931
  ... Content-Disposition: form-data; name="UPDATE_SUBMIT"
  ... 
  ... Add
  ... -----------------------------8474411127918531132143183931--
  ... """)
  HTTP/1.1 303 See Other
  ...


Next, we'll add the group folder:

  >>> print http(r"""
  ... POST /++etc++site/SiteManagement/index.html HTTP/1.1
  ... Authorization: Basic mgr:mgrpw
  ... Content-Type: application/x-www-form-urlencoded
  ... 
  ... activeTool=IPrincipalSearchPlugin""")
  HTTP/1.1 200 Ok
  ...

  >>> print http(r"""
  ... POST /++etc++site/SiteManagement/AddGroupFolder.html= HTTP/1.1
  ... Authorization: Basic mgr:mgrpw
  ... Content-Type: multipart/form-data; boundary=---------------------------1160081710811409419323271465
  ... Referer: http://localhost:8081/++etc++site/AddIPrincipalSearchPluginTool/AddGroupFolder.html=
  ... 
  ... -----------------------------1160081710811409419323271465
  ... Content-Disposition: form-data; name="field.prefix"
  ... 
  ... test.
  ... -----------------------------1160081710811409419323271465
  ... Content-Disposition: form-data; name="UPDATE_SUBMIT"
  ... 
  ... Add
  ... -----------------------------1160081710811409419323271465
  ... Content-Disposition: form-data; name="add_input_name"
  ... 
  ... 
  ... -----------------------------1160081710811409419323271465--
  ... """)
  HTTP/1.1 303 See Other
  ...

And add some groups:

  >>> print http(r"""
  ... POST /++etc++site/tools/GroupFolder/+/AddGroupInformation.html%3D HTTP/1.1
  ... Authorization: Basic mgr:mgrpw
  ... Content-Type: multipart/form-data; boundary=---------------------------57051497716357005611441891504
  ... Referer: http://localhost:8081/++etc++site/tools/GroupFolder/+/AddGroupInformation.html=
  ... 
  ... -----------------------------57051497716357005611441891504
  ... Content-Disposition: form-data; name="field.title"
  ... 
  ... Test1
  ... -----------------------------57051497716357005611441891504
  ... Content-Disposition: form-data; name="field.description"
  ... 
  ... 
  ... -----------------------------57051497716357005611441891504
  ... Content-Disposition: form-data; name="UPDATE_SUBMIT"
  ... 
  ... Add
  ... -----------------------------57051497716357005611441891504
  ... Content-Disposition: form-data; name="add_input_name"
  ... 
  ... 
  ... -----------------------------57051497716357005611441891504--
  ... """)
  HTTP/1.1 303 See Other
  ...


  >>> print http(r"""
  ... POST /++etc++site/tools/GroupFolder/+/AddGroupInformation.html%3D HTTP/1.1
  ... Authorization: Basic mgr:mgrpw
  ... Content-Type: multipart/form-data; boundary=---------------------------1162360160489428309570988744
  ... Referer: http://localhost:8081/++etc++site/tools/GroupFolder/+/AddGroupInformation.html=
  ... 
  ... -----------------------------1162360160489428309570988744
  ... Content-Disposition: form-data; name="field.title"
  ... 
  ... Test2
  ... -----------------------------1162360160489428309570988744
  ... Content-Disposition: form-data; name="field.description"
  ... 
  ... 
  ... -----------------------------1162360160489428309570988744
  ... Content-Disposition: form-data; name="UPDATE_SUBMIT"
  ... 
  ... Add
  ... -----------------------------1162360160489428309570988744
  ... Content-Disposition: form-data; name="add_input_name"
  ... 
  ... 
  ... -----------------------------1162360160489428309570988744--
  ... """)
  HTTP/1.1 303 See Other
  ...

Now we'll configure our pluggable-authentication utility to use the
group folder:

  >>> print http(r"""
  ... POST /++etc++site/default/PA/@@edit.html HTTP/1.1
  ... Authorization: Basic mgr:mgrpw
  ... Content-Type: multipart/form-data; boundary=---------------------------13414337386198656711891559433
  ... Referer: http://localhost:8081/++etc++site/default/PA/@@edit.html
  ... 
  ... -----------------------------13414337386198656711891559433
  ... Content-Disposition: form-data; name="field.factories.to"
  ... 
  ... Default
  ... -----------------------------13414337386198656711891559433
  ... Content-Disposition: form-data; name="field.searchers.to"
  ... 
  ... GroupFolder
  ... -----------------------------13414337386198656711891559433
  ... Content-Disposition: form-data; name="UPDATE_SUBMIT"
  ... 
  ... Change
  ... -----------------------------13414337386198656711891559433
  ... Content-Disposition: form-data; name="field.factories"
  ... 
  ... Default
  ... -----------------------------13414337386198656711891559433
  ... Content-Disposition: form-data; name="field.searchers"
  ... 
  ... GroupFolder
  ... -----------------------------13414337386198656711891559433--
  ... """)
  HTTP/1.1 200 Ok
  ...

Now, if we search for a group, but don't supply a string:

  >>> print http(r"""
  ... POST /@@grant.html HTTP/1.1
  ... Authorization: Basic mgr:mgrpw
  ... Content-Type: application/x-www-form-urlencoded
  ... 
  ... field.principal.displayed=y&field.principal.MC5Hcm91cEZvbGRlcg__.query.field.search=&field.principal.MC5Hcm91cEZvbGRlcg__.query.search=Search&field.principal.MQ__.query.searchstring=""")
  HTTP/1.1 200 Ok
  ...Test1...Test2...

We get both of our groups in the result.
