"identificationTag \"addAci\", " +
"identificationTag \"searchAci\", " +
    public void testGrantAdministrators() throws NamingException    {        // create the non-admin user        createUser( "billyd", "billyd" );        // try an add operation which should fail without any ACI        assertFalse( checkCanSearchAs( "billyd", "billyd" ) );        // Gives grantAdd perm to all users in the Administrators group for        // entries and all attribute types and values        createAccessControlSubentry( "searchAdmin", "{ " +                "identificationTag \"addAci\", " +                "precedence 14, " +                "authenticationLevel none, " +                "itemOrUserFirst userFirst: { " +                "userClasses { userGroup { \"cn=Administrators,ou=groups,ou=system\" } }, " +                "userPermissions { { " +                "protectedItems {entry, allUserAttributeTypesAndValues}, " +                "grantsAndDenials { grantRead, grantReturnDN, grantBrowse } } } } }" );        // see if we can now add that test entry which we could not before        // add op should still fail since billd is not in the admin group        assertFalse( checkCanSearchAs( "billyd", "billyd" ) );        // now add billyd to the Administrator group and try again        addUserToGroup( "billyd", "Administrators" );        // try an add operation which should succeed with ACI and group membership change        assertTrue( checkCanSearchAs( "billyd", "billyd" ) );    }