createAccessControlSubentry( "billyAddBySubtree", "{ " + "identificationTag \"addAci\", " +
createAccessControlSubentry( "billySearchBySubtree", "{ " + "identificationTag \"searchAci\", " +
    public void testGrantSearchBySubtree() throws NamingException    {        // create the non-admin user        createUser( "billyd", "billyd" );        // try an add operation which should fail without any ACI        assertFalse( checkCanSearchAs( "billyd", "billyd" ) );        // now add a subentry that enables user billyd to add an entry below ou=system        createAccessControlSubentry( "billyAddBySubtree", "{ " +                "identificationTag \"addAci\", " +                "precedence 14, " +                "authenticationLevel none, " +                "itemOrUserFirst userFirst: { " +                "userClasses { subtree { { base \"ou=users,ou=system\" } } }, " +                "userPermissions { { " +                "protectedItems {entry, allUserAttributeTypesAndValues}, " +                "grantsAndDenials {  grantRead, grantReturnDN, grantBrowse } } } } }" );        // should work now that billyd is authorized by the subtree userClass        assertTrue( checkCanSearchAs( "billyd", "billyd" ) );    }