I'm working on a policy which shall assign ADS Group Memberships to new

Therefore I do a query which asks ADS for all groups which have the
value of a certain attr in their description.
All found groups are written to a nodeset and afterwards I took a
for-each action in the next rule to generate the modify-group events.

That worked so far.
The problem is now, that I would like to do the query also in a for-each
action, because I'd like to do the query for different searchbases.

I tried it that way:

<description>1 -- Dynamische Gruppenzuweisung durch ein
<comment xml:space="preserve">wird angewendet wenn groupMembership auf
"eins" steht</comment>
<if-class-name mode="nocase" op="equal">User</if-class-name>
<if-global-variable mode="regex" name="groupMembership"
<if-op-attr name="~groupAttr1~" op="available"/>
<if-op-attr mode="nocase" name="~groupAttr1~" op="not-equal"/>
<do-set-local-variable name="groupValue">
<token-op-attr name="~groupAttr1~"/>
<do-set-local-variable name="adScope">
<token-global-variable name="adsSyncScope"/>
<token-local-variable name="adScope"/>
<do-set-local-variable name="group">
<token-local-variable name="group"/>
expression="query:search($destQueryProcessor,&quot ;subtree&quot;,association,concat($current-node,&apos;,&apos;,&apos;~adsTreeName~&apos,&apos;Group&apos;,&apos;Description&apos;,$groupV alue,&apos;&apos"/>
<do-set-local-variable name="groupCounter">
<token-xpath expression="count($group)"/>

The problem of that solution is, that the first time concatening the
values, $group is empty and so $group + the result of the query ends up
in something like that:

Arg Value: {"",<instance> @class-name = "Group" @src-dn =
@class-name = "Group" @src-dn =
@class-name = "Group" @src-dn =
@class-name = "Group" @src-dn =

and $groupCount is 5 instead of 4 because there is this empty string at
the beginning.

How to change this policy to concat the results of both queries correctly?

Any help would be appreciated.