Wildcards for Resource, User, and Group Names

The MLDAP ESM Module supports three wildcards:

*	Match zero or more characters, except the period "." (full stop, dot) character. This exception is generally only useful in dataset names, where it indicates that the wildcard applies only to the current DSN qualifier.
**	Match zero or more characters, including the period ".". Usually used only in dataset names, to indicate any number of qualifiers, since the period character does not usually appear in other names.
+	Match exactly one character, except the period ".". This is not treated as a wildcard by default; it must be enabled in the module configuration using the `plus-wildcard` option.

Wildcards can appear in two places:

In the names of resource objects in the LDAP directory. When a resource object in the directory has a name with a wildcard (sometimes called a generic name), its ACL applies to all the resources with a name that matches that pattern, unless another resource definition with a more-specific name (see Match Rank) exists.
In user and group names in an Access Control Entry. Such an entry will apply to all users or groups with names that match the pattern, unless another ACE with a more-specific name (see Match Rank) exists in that ACL.