Wildcards for Resource, User, and Group Names

The MLDAP ESM Module supports the following wildcards:

*	Match zero or more characters, except the period "." (full stop, dot) character. This exception is generally only useful in dataset names, where it indicates that the wildcard applies only to the current DSN qualifier.
**	Match zero or more characters, including the period ".". Usually used only in dataset names, to indicate any number of qualifiers, since the period character does not usually appear in other names.
+	Match exactly one character, except the period ".". This is not treated as a wildcard by default; it must be enabled in the module configuration using the `plus-wildcard` option.
.**	Depending on configuration, this may be treated as a wildcard matching the empty string or any string starting with "."; or it may be treated as "**" if it appears at the end of a name. See MLDAP ESM Module Custom Configuration Information for more information on setting the `dss-wildcard` option in the module configuration.
%	Match exactly one character, except the period ".". This is not treated as a wildcard by default; it must be enabled in the module configuration using the `percent-wildcard` option. See MLDAP ESM Module Custom Configuration Information for more information on setting the `percent-wildcard` option in the module configuration.

Wildcards can appear in two places:

In the names of resource objects in the LDAP directory. When a resource object in the directory has a name with a wildcard (sometimes called a generic name), its ACL applies to all the resources with a name that matches that pattern, unless another resource definition with a more-specific name exists. See Match Rank for more information.
In user and group names in an Access Control Entry. Such an entry will apply to all users or groups with names that match the pattern, unless another ACE with a more-specific name exists in that ACL. See Match Rank for more information.