AttributeValuePair settings for Subject of Policy Creation

Question

Hi,
I am trying to create policies using the command line tool amadmin. At this point I can create the policy with the desired rule but the subject isn't created properly.
I am using Identity Server 6.1 on Solaris 9 and Directory Server 5.2 on a different Solaris 9 box.
When I run asadmin, the user is authenticated and the policy is created. The policy consists of both a rule and a subject. The subject has the desired type LDAP Group but no groups are showing up (so it's essentially an empty subject of the right type).
I think this may relate to an incorrect value that I'm filling into the Attribute element under the Subject. I have not been able to find any documentation about what this value should be and so I've been guessing with no luck. Here is my XML file (values bounded by underscores have been subbed in for security):
<?xml version="1.0" encoding="ISO-8859-1"?>
<!--
    Copyright (c) 2003 Sun Microsystems, Inc. All rights reserved
    Use is subject to license terms.
-->
<!DOCTYPE Requests
    PUBLIC "-//iPlanet//Sun ONE Identity Server 6.1 Admin CLI DTD//EN"
    "jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>
<!--  CREATE REQUESTS -->
<Requests>   
     <OrganizationRequests DN="_basedn_">
          <CreatePolicy createDN="_basedn_">
               <Policy name="<my_policy>" referralPolicy="false" >
                    <Rule name="my_rule">
                         <ServiceName name="iPlanetAMWebAgentService" />
                         <ResourceName name="_resource_" />
                         <AttributeValuePair>
                              <Attribute name="GET" />
                              <Value>allow</Value>
                         </AttributeValuePair>
                         <AttributeValuePair>
                              <Attribute name="POST" />
                              <Value>allow</Value>
                         </AttributeValuePair>
                    </Rule>
                    <Subjects name="my_subjects" description="">
                         <Subject name="my_subject_1" type="LDAPGroups">
                              <AttributeValuePair>
                                   <Attribute name="?????" />
                                   <Value>_full_dn_</Value>
                              </AttributeValuePair>
                         </Subject>
                    </Subjects>
               </Policy>
          </CreatePolicy>
     </OrganizationRequests>
</Requests>One thing I've noticed is that changing the text of the value from the full dn of the LDAP group to gibberish has no effect on debug or verbose output. I'm not getting any errors at all from -v or -d, it just isn't putting the LDAP group into the policy.
Thanks for any help, I'm not sure what to do here.
Dave.

Answer 1

Try this:
<Subjects name="my_subjects" description="">
<Subject name="my_subject_1" type="LDAPGroups" includeType="inclusive">
                              <AttributeValuePair>
                                   <Attribute name="Values" />
                                   <Value>fulldn_</Value>
                              </AttributeValuePair>
                         </Subject>
</Subjects>