So how do nested roles work?

Question

I'm trying to define an admin role that can be assigned to certain users in my directory, while enabling me to define a separate password policy for just this set of users.
What I want to do is this:
- create a managed admin role in a specific area of my directory (e.g. ou=roles, o=suffix)
- add users to this role (they sit in ou=users,o=suffix)
Now, I'm aware the roles only have scope over the subtree where they are created, so I've created a nested role at the root level (o=suffix) and added the managed admin role (cn=admin role,ou=roles,o=suffix).
As far as I'm concerned this should give my admin role scope over the whole o=suffix tree?
Unfortunately when I try to open up access using an ACI it doesn't seem to work. The only way I can get it to work is if I create the managed role at the suffix level (i.e. cn=admin role, o=suffix) and reference that role in the ACI.
What am I missing here?

Answer 1

http://docs.iplanet.com/docs/manuals/uds/50/toolref.pdf
Page 159
You should read the document but there is a snippet from the doc:
Nesting event statements You can nest an event statement in your statement
block either by using another event statement or by invoking a method that
contains an event statement.
A typical example is when you want to open a new window and the Display
method for the window contains an event loop. Another example is using the
start task statement to start a new task and then use the event statement to wait
for the return or exception events.
Code Example 3-13 Nesting event statements
event loop
when <quit_button>.Click do
exit;
when <start_task>.Click do
tsk_desc : TaskDesc;
tsk_desc = start task o.meth() where completion =
event;
event loop
when o.meth_return(x = return) do
when o.meth_exception(e = exception, f = errs);
when <cancel_button>.Click do
tsk_desc.SetCancel();
end event;
when <cancel_button>.Click do
exit;
end event;
If more than one event statement is registered for the same event, the event
statement that is currently executing when the event reaches the top of the queue is
the one that handles the event. Once the event has been handled, it is removed
from the queue. Therefore, an event is never handled more than once.
ka