"userPermissions { { " +
"protectedItems {entry, allUserAttributeTypesAndValues}, " +
"grantsAndDenials { grantRead, grantReturnDN, grantBrowse } } } } }" );
// check and see if we can access the subentry now
assertNotNull( checkCanSearhSubentryAs( "billyd", "billyd", new LdapName( "cn=anybodySearch" ) ) );
// now add a denial to prevent all users except the admin from accessing the subentry
addSubentryACI( "{ " +
"identificationTag \"searchAci\", " +
"precedence 14, " +
"authenticationLevel none, " +
"itemOrUserFirst userFirst: { " +
"userClasses { allUsers }, " +
"userPermissions { { " +
"protectedItems {entry, allUserAttributeTypesAndValues}, " +
"grantsAndDenials { denyRead, denyReturnDN, denyBrowse } } } } }" );
// now we should not be able to access the subentry with a search
assertNull( checkCanSearhSubentryAs( "billyd", "billyd", new LdapName( "cn=anybodySearch" ) ) );
}