// get a context as the user and try a lookup of a non-existant entry under ou=groups,ou=system
LdapConnection userCtx = getConnectionAs( "uid=billyd,ou=users,ou=system", "billyd" );
// we should not see ou=groups,ou=system for the remaining name
SearchResultEntry entry = ( SearchResultEntry ) userCtx.lookup( "cn=blah,ou=groups" );
assertNull( entry );
// now delete and replace subentry with one that does not excluse ou=groups,ou=system
deleteAccessControlSubentry( "selectiveDiscloseOnError" );
createAccessControlSubentry( "selectiveDiscloseOnError", "{ " + "identificationTag \"searchAci\", "