Fedora directory users - May 2009 - Wildcards in groupdn in ACIs

Hello, all.  We are still refining how we want to deploy 389 in a
multi-tenant environment.  To grant access to the admins for each tenant
to manage their own external contact lists, we created an ACI as
follows:

(targetattr = "*") (target =
"ldap:///($dn),o=external,dc=ssiservices,
dc=biz") (version 3.0;acl "Client Administrators External";allow
(all)(groupdn
"ldap:///cn=*ldapadmins,ou=groups,[$dn],o=internal,dc=ssiservices,dc=biz");)

Each tenant has a client number which is prefixed to the ldapadmins
group cn so that we don''t have thousands of groups with the same cn so,
for example, c001ldapadmins, c002ldapadmins.  Hence the * in the cn.
However, it does not seem to work.  Client admins are told they do not
have rights to add new objects.  If we replace the * with the prefix,
e.g.,
"ldap:///cn=c001ldapadmins,ou=groups,[$dn],o=internal,dc=ssiservices,dc=biz"),
it works fine.  Is there a way to use wildcards in a groupdn? The literature
explicitly says so for userdn but not groupdn.  Thanks - John

PS - I first tried sending this to 389-users but that mail bounced -
John
-- 
John A. Sullivan III
Open Source Development Corporation

Street Preacher: Are you SAVED?????!!!!!!
Educated Skeptic: Saved from WHAT?????!!!!!!
Educated Believer: From our selfishness that hurts the ones we love
                   and condemns us to an eternity of hurting each other.
http://www.spiritualoutreach.com
Christianity that makes sense