[Fedora-directory-users] Wildcards in groupdn in ACIs

[John A. Sullivan III]

Hello, all.  We are still refining how we want to deploy 389 in a
multi-tenant environment.  To grant access to the admins for each tenant
to manage their own external contact lists, we created an ACI as
follows:

(targetattr = "*") (target = "ldap:///($dn),o=external,dc=ssiservices,
dc=biz") (version 3.0;acl "Client Administrators External";allow
(all)(groupdn =
"ldap:///cn=*ldapadmins,ou=groups,[$dn],o=internal,dc=ssiservices,dc=biz");)

Each tenant has a client number which is prefixed to the ldapadmins
group cn so that we don't have thousands of groups with the same cn so,
for example, c001ldapadmins, c002ldapadmins.  Hence the * in the cn.
However, it does not seem to work.  Client admins are told they do not
have rights to add new objects.  If we replace the * with the prefix,
e.g.,
"ldap:///cn=c001ldapadmins,ou=groups,[$dn],o=internal,dc=ssiservices,dc=biz"), it works fine.  Is there a way to use wildcards in a groupdn? The literature explicitly says so for userdn but not groupdn.  Thanks - John

PS - I first tried sending this to 389-users but that mail bounced -
John
-- 
John A. Sullivan III
Open Source Development Corporation

Street Preacher: Are you SAVED?????!!!!!!
Educated Skeptic: Saved from WHAT?????!!!!!!
Educated Believer: From our selfishness that hurts the ones we love
                   and condemns us to an eternity of hurting each other.
http://www.spiritualoutreach.com
Christianity that makes sense