XPATH seems to sometime select only part of what it should in idm 3.5. The following modify shall be stripped off any empty nodes with a dirxml script policy:

<rule>
<description>Strip Empty Nodes</description>
<conditions/>
<actions>
<do-strip-xpath expression='add-attr/value[text()=""]'/>
<do-strip-xpath expression="add-attr[count(value)=0]"/>
<do-strip-xpath expression='modify-attr/add-value/value[text()=""]'/>
<do-strip-xpath expression="modify-attr/add-value[count(value)=0]"/>
<do-strip-xpath expression='modify-attr/remove-value/value[text()=""]'/>
<do-strip-xpath expression="modify-attr/remove-value[count(value)=0]"/>
<do-strip-xpath expression="modify-attr[count(*)=0]"/>
<do-trace-message>
<arg-string>
<token-xml-serialize>
<token-xpath expression="../*"/>
</token-xml-serialize>
</arg-string>
</do-trace-message>
<do-veto/>
</actions>
</rule>

This works perfectly in designer's simulator, all nodes without a <value> tag get removed. But here's what I get in a real trace on my server (sles 9 sp3, edir 8.7.3.9, idm 3.5.1):

<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.5.1.20070411 ">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<modify class-name="group" event-id="hamburgmeta03#20070704104839#3#1" qualified-src-dn="O=MUMMERT\OU=de\OU=mummert\OU=hamburg\OU=group s_secure\CN=AAA-TEST-77" src-dn="\MUMMERT-META\MUMMERT\de\mummert\hamburg\groups_secure\AAA-TEST-77" src-entry-id="47511" timestamp="1183546119#1">
<association state="associated">DB1229DA78191803C12572DF00474CF 6</association>
<modify-attr attr-name="GroupPersNo">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="GroupPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Lothar Haeger</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Melanie Berg</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberRestrictedPersNo">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberRestrictedPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stephan Kluever</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberPersNo">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberPersNo">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberPersNo">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMember">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="GroupMember">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Lothar Haeger</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMember">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Melanie Berg</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMember">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMember">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Lothar Haeger</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Melanie Berg</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberRestricted">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberRestricted">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stephan Kluever</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberRestrictedNotesName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberRestrictedNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stephan Kluever</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberRestrictedPersNoName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberRestrictedPersNoName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stephan Kluever</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Member">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Member">
<add-value/>
</modify-attr>
<modify-attr attr-name="Member">
<add-value/>
</modify-attr>
<modify-attr attr-name="Member">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Member">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
</modify>
</input>
</nds>
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST:Applying policy: Output Transform 2.
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Applying to modify #1.
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Evaluating selection criteria for rule 'Strip Empty Nodes'.
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Rule selected.
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Applying rule 'Strip Empty Nodes'.
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Action: do-strip-xpath("add-attr/value[text()=""]").
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Action: do-strip-xpath("add-attr[count(value)=0]").
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Action: do-strip-xpath("modify-attr/add-value/value[text()=""]").
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Action: do-strip-xpath("modify-attr/add-value[count(value)=0]").
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Action: do-strip-xpath("modify-attr/remove-value/value[text()=""]").
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Action: do-strip-xpath("modify-attr/remove-value[count(value)=0]").
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Action: do-strip-xpath("modify-attr[count(*)=0]").
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Action: do-trace-message(token-xml-serialize(token-xpath("../*"))).
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: arg-string(token-xml-serialize(token-xpath("../*")))
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: token-xml-serialize(token-xpath("../*"))
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: token-xml-serialize(token-xpath("../*"))
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: token-xpath("../*")
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Token Value: {<modify> @class-name = "group" @event-id = "hamburgmeta03#20070704104839#3#1" @qualified-src-dn = "O=MUMMERT\OU=de\OU=mummert\OU=hamburg\OU=groups_s ecure\CN=AAA-TEST-77" @src-dn = "\MUMMERT-META\MUMMERT\de\mummert\hamburg\groups_secure\AAA-TEST-77" @src-entry-id = "47511" @timestamp = "1183546119#1"}.
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Arg Value: {<modify> @class-name = "group" @event-id = "hamburgmeta03#20070704104839#3#1" @qualified-src-dn = "O=MUMMERT\OU=de\OU=mummert\OU=hamburg\OU=groups_s ecure\CN=AAA-TEST-77" @src-dn = "\MUMMERT-META\MUMMERT\de\mummert\hamburg\groups_secure\AAA-TEST-77" @src-entry-id = "47511" @timestamp = "1183546119#1"}.
12:48:39 85A50BB0 Drvrs: DRV_SelfServ ST: Token Value: "<modify class-name="group" event-id="hamburgmeta03#20070704104839#3#1" qualified-src-dn="O=MUMMERT\OU=de\OU=mummert\OU=hamburg\OU=group s_secure\CN=AAA-TEST-77" src-dn="\MUMMERT-META\MUMMERT\de\mummert\hamburg\groups_secure\AAA-TEST-77" src-entry-id="47511" timestamp="1183546119#1">
<association state="associated">DB1229DA78191803C12572DF00474CF 6</association>
<modify-attr attr-name="GroupPersNo">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="GroupPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Lothar Haeger</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Melanie Berg</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberRestrictedPersNo">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberRestrictedPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stephan Kluever</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberPersNo">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberPersNo">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
12:48:39 85A50BB0 Drvrs: <modify-attr attr-name="GroupMember">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="GroupMember">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Lothar Haeger</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMember">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Melanie Berg</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMember">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMember">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Lothar Haeger</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Melanie Berg</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="GroupMemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberRestricted">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberRestricted">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stephan Kluever</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberRestrictedNotesName">
<remove-all-values/>
</modify-attr>
12:48:39 85A50BB0 Drvrs: <modify-attr attr-name="MemberRestrictedNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stephan Kluever</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberRestrictedPersNoName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberRestrictedPersNoName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stephan Kluever</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Member">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Member">
<add-value/>
</modify-attr>
<modify-attr attr-name="Member">
<add-value/>
</modify-attr>
<modify-attr attr-name="Member">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Member">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberNotesName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<add-value/>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
12:48:39 85A50BB0 Drvrs: <add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Stefan Malcherrek</value>
</add-value>
</modify-attr>
<modify-attr attr-name="MemberPersNoName">
<add-value>
<value>\MUMMERT-META\MUMMERT\de\users\Matthias Sill</value>
</add-value>
</modify-attr>
</modify>".

There were 8 empty <add-value/> tags but only the first two of them have been removed ("MemberPersNo" attribute) while the others remain (e.g. "MemberPersNoName" attribute). I can see the same behaviour in a for-each loop where only part of the targeted attribute values are being reformatted, simply because the XPATH statemant that worked perfectly for months in idm 3.01 now doesn't match all values anymore.

Very weird, unless I am too stupid to see the obvious mistake in my policy... :-) Is that a bug or some new feature I missed while skimming the readme?

Cheers, Lothar