Performing query on IDM 3.5 on 8.8.1

The attribute we are reading is defined as:

attributetype ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID'
DESC 'Security ID'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )

07:51:31 92BDBBA0 Drvrs: NxSettings ST: Action:
do-set-local-variable("sambaDomainSID",scope="policy",token-query(class-name="sambaDomain",datastore="src",max-result-count="1",scope="subordinates",arg-dn("com\willeke"),token-attr("sambaSID"))).
07:51:31 92BDBBA0 Drvrs: NxSettings ST:
arg-string(token-query(class-name="sambaDomain",datastore="src",max-result-count="1",scope="subordinates",arg-dn("com\willeke"),token-attr("sambaSID")))
07:51:31 92BDBBA0 Drvrs: NxSettings ST:
token-query(class-name="sambaDomain",datastore="src",max-result-count="1",scope="subordinates",arg-dn("com\willeke"),token-attr("sambaSID"))
07:51:31 92BDBBA0 Drvrs: NxSettings ST: arg-dn("com\willeke")
07:51:31 92BDBBA0 Drvrs: NxSettings ST: token-text("com\willeke")
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Arg Value: "com\willeke".
07:51:31 92BDBBA0 Drvrs: NxSettings ST: arg-string(token-attr("sambaSID"))
07:51:31 92BDBBA0 Drvrs: NxSettings ST: token-attr("sambaSID")
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Token Value: "".
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Arg Value: "".
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Query from policy
07:51:31 92BDBBA0 Drvrs: NxSettings ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.5.0.20070315 ">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<query-ex class-name="sambaDomain" dest-dn="com\willeke"
max-result-count="1" scope="subordinates">
<search-class class-name="sambaDomain"/>
<read-attr/>
</query-ex>
</input>
</nds>
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Pumping XDS to eDirectory.
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Performing operation query-ex
for com\willeke.
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Query from policy result
07:51:31 92BDBBA0 Drvrs: NxSettings ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.5.0.20070315 ">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<output>
<instance class-name="sambaDomain"
qualified-src-dn="dc=com\dc=willeke\sambaDomainName=WILLEKE"
src-dn="\WILLEKETREE\com\willeke\WILLEKE" src-entry-id="44610"/>
<query-token>rO0ABXNyACxjb20ubm92ZWxsLm5kcy5kaXJ4bWwuZW5n aW5lLk5EU1JlYWRlciRUb2tlbuWeJE0ga5xBAgACSgAFc3RhbX BJAAlzdGF0ZUhhc2h4cAAAARUtDuS5Afo5uw==</query-token>
<status level="success"></status>
</output>
</nds>
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Token Value: "".
07:51:31 92BDBBA0 Drvrs: NxSettings ST: Arg Value: "".

Why does a value of
sambaSID=S-1-5-21-852355746-2165432268-4188094699
Come back empty?

An ldapsearch works fine.
ldapsearch -h 192.168.1.4 -b dc=willeke,dc=com -D
cn=jim,ou=butler,ou=people,dc=willeke,dc=com "(Objectclass=sambaDomain)"
sambaSid
version: 1

#
# filter: (Objectclass=sambaDomain)
# requesting: sambaSid
#

# WILLEKE,willeke,com
dn: sambaDomainName=WILLEKE,dc=willeke,dc=com
sambaSid: S-1-5-21-852355746-2165432268-4188094699

Thanks
-jim