Thanks in advance.

We need reformat the Group Membership form an LDAP DN to NDS DN.
For both added values and removed values.
And of course, we may have multiple values of each.
The input document looks like this:

<input>
<modify class-name="User" event-id="1" src-dn="odjfs\people\WilleJ02">
<association>cn=WilleJ02,ou=people,o=odjfs</association>
<modify-attr attr-name="Login Disabled">
<add-value>
<value type="string">false</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Description">
<remove-all-values/>
<add-value>
<value type="string">replaced</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Group Membership">
<remove-value>
<value
type="string">cn=buyin-policy,ou=buyInRole,ou=buyin,ou=applications,ou=Us erApp,o=services</value>
</remove-value>
</modify-attr>
<modify-attr attr-name="Group Membership">
<add-value>
<value
type="string">cn=Columbiana,ou=buyInCounty,ou=buyi n,ou=applications,ou=UserApp,o=services</value>
</add-value>
</modify-attr>
<operation-data startedAs="modify">
<return-to-me command="modify" dn="cn=WilleJ02,ou=people,o=odjfs"
requestID="1"/>
</operation-data>
</modify>
</input>

This Rule only reformats the "Added" value.
<rule disabled="true">
<description>TranformGrouppppps</description>
<conditions>
<and>
<if-op-attr name="Group Membership" op="available"/>
</and>
</conditions>
<actions>
<do-reformat-op-attr name="Group Membership">
<arg-value>
<token-parse-dn dest-dn-format="dest-dn" src-dn-format="ldap">
<token-attr name="Group Membership"/>
</token-parse-dn>
</arg-value>
</do-reformat-op-attr>
</actions>
</rule>


This rule comes up empty:
<rule>
<description>Reformat Groups</description>
<comment xml:space="preserve">Loop though OperationAttributes for Added
Values and though RemovedAttributes for removed values.
Add/remove the UserDN to Member and Security Equals on the group and
add/remove Security Equals on the UserDN</comment>
<conditions>
<and>
<if-op-attr name="Group Membership" op="available"/>
</and>
</conditions>
<actions>
<do-for-each>
<arg-node-set>
<token-op-attr name="Group Membership"/>
</arg-node-set>
<arg-actions>
<do-reformat-op-attr name="Group Membership">
<arg-value type="string">
<token-dest-dn/>
</arg-value>
</do-reformat-op-attr>
</arg-actions>
</do-for-each>
</actions>
</rule>

10:29:46 Drvrs: DSML PT: Applying policy: Transform DNs.
10:29:46 Drvrs: DSML PT: Applying to modify #1.
10:29:46 Drvrs: DSML PT: Evaluating selection criteria for rule 'Reformat
Groups'.
10:29:46 Drvrs: DSML PT: (if-op-attr 'Group Membership' available) = TRUE.
10:29:46 Drvrs: DSML PT: Rule selected.
10:29:46 Drvrs: DSML PT: Applying rule 'Reformat Groups'.
10:29:46 Drvrs: DSML PT: Action:
do-for-each(arg-node-set(token-op-attr("Group
Membership")),arg-actions(do-reformat-op-attr("Group
Membership",token-dest-dn()))).
10:29:46 Drvrs: DSML PT: arg-node-set(token-op-attr("Group Membership"))
10:29:46 Drvrs: DSML PT: token-op-attr("Group Membership")
10:29:46 Drvrs: DSML PT: Token Value: {<value> @type = "string"}.
10:29:46 Drvrs: DSML PT: Arg Value: {<value> @type = "string"}.
10:29:46 Drvrs: DSML PT: arg-actions(do-reformat-op-attr("Group
Membership",token-dest-dn()))
10:29:46 Drvrs: DSML PT: Performing actions for local-variable(current-node)
= <value> @type = "string".
10:29:46 Drvrs: DSML PT: Action: do-reformat-op-attr("Group
Membership",token-dest-dn()).
10:29:46 Drvrs: DSML PT: arg-string(token-dest-dn())
10:29:46 Drvrs: DSML PT: token-dest-dn()
10:29:46 Drvrs: DSML PT: Token Value: "".
10:29:46 Drvrs: DSML PT: Arg Value: "".
10:29:46 Drvrs: DSML PT: arg-string(token-dest-dn())
10:29:46 Drvrs: DSML PT: token-dest-dn()
10:29:46 Drvrs: DSML PT: Token Value: "".
10:29:46 Drvrs: DSML PT: Arg Value: "".


Thanks
-jim