I'm trying to modify Lothar's PWNotify driver to do some additional stuff. Basically, I need to send a notification to a user's assigned administrator (this is not the manager). So far so good, here's my modified P-ET-260 policy rule:

Code:
<rule>
		<description>bca Biuld Notify Superusers For Idle Accounts List</description>
		<comment name="author" xml:space="preserve">Lothar Haeger</comment>
		<conditions>
			<or>
				<if-xpath op="true">self::status[@type="notification"]</if-xpath>
			</or>
			<or>
				<if-global-variable mode="nocase" name="AccountIdle1Superuser" op="equal">true</if-global-variable>
			</or>
		</conditions>
		<actions>
			<do-for-each>
				<arg-node-set>
					<token-xpath expression="AccountIdle1/instance"/>
				</arg-node-set>
				<arg-actions>
					<do-set-local-variable name="CurrentBCAEconOperatorDN" scope="policy">
						<arg-string>
							<token-xpath expression="attr[@attr-name='bcaEconOperatorDN']/value/text()"/>
						</arg-string>
					</do-set-local-variable>
					<do-set-local-variable disabled="true" name="CurrentBCAEconOperatorDN" scope="policy">
						<arg-string>
							<token-text xml:space="preserve">cn=EIK200417978,ou=econoperators,o=bca</token-text>
						</arg-string>
					</do-set-local-variable>
					<do-trace-message color="white" level="3">
						<arg-string>
							<token-text xml:space="preserve">Current notification of Superuser of EconOperator: </token-text>
							<token-local-variable name="CurrentBCAEconOperatorDN"/>
						</arg-string>
					</do-trace-message>
					<do-append-xml-element expression="." name="AccountIdle1Superuser"/>
					<do-append-xml-element expression="AccountIdle1Superuser" name="MUHAHA"/>
					<do-set-local-variable name="filterForSuperuser" scope="policy">
						<arg-string>
							<token-text xml:space="preserve">(&amp;</token-text>
							<token-text xml:space="preserve">(objectClass=user)</token-text>
							<token-text xml:space="preserve">(bcaEconOperatorDN=</token-text>
							<token-local-variable name="CurrentBCAEconOperatorDN"/>
							<token-text xml:space="preserve">)</token-text>
							<token-text xml:space="preserve">(bcaIsSuperUser=1)</token-text>
							<token-text xml:space="preserve">)</token-text>
						</arg-string>
					</do-set-local-variable>
					<do-set-local-variable name="idle-attrlistForSuperuser" scope="policy">
						<arg-string>
							<token-text xml:space="preserve">mail</token-text>
						</arg-string>
					</do-set-local-variable>
					<do-clone-xpath dest-expression="AccountIdle1Superuser" src-expression="es:bh_LdapSearch($LdapConnect, $LdapPort, $LdapUseTls, $LdapTlsKeystore, $LdapTlsStorepass, $LdapLogin, $LdapPassword, '~UserLdapSearchBase~', '~UserLdapSearchScope~', $filterForSuperuser, $idle-attrlistForSuperuser, ~LdapMaxResultSet~)"/>
				</arg-actions>
			</do-for-each>
		</actions>
	</rule>
Here's a Level 3 trace from the execution of the above rule:

Code:
[06/20/17 16:47:41.369]:BCA Idle Accounts Service PT:Applying policy: %+C%14CP-ET-260-PWNotifyAcct (Check Accounts)%-C.
[06/20/17 16:47:41.369]:BCA Idle Accounts Service PT:  Applying to status #1.
[06/20/17 16:47:41.370]:BCA Idle Accounts Service PT:    Evaluating selection criteria for rule 'bca Build Notify Users For Idle Accounts List'.
[06/20/17 16:47:41.370]:BCA Idle Accounts Service PT:      (if-xpath true "self::status[@type="notification"]") = TRUE.
[06/20/17 16:47:41.371]:BCA Idle Accounts Service PT:      (if-global-variable 'AccountIdle1User' equal "true") = TRUE.
[06/20/17 16:47:41.371]:BCA Idle Accounts Service PT:    Rule selected.
[06/20/17 16:47:41.372]:BCA Idle Accounts Service PT:    Applying rule 'bca Build Notify Users For Idle Accounts List'.
[06/20/17 16:47:41.372]:BCA Idle Accounts Service PT:      Action: do-append-xml-element("AccountIdle1",".").
[06/20/17 16:47:41.373]:BCA Idle Accounts Service PT:      Action: do-append-xml-element("From","AccountIdle1").
[06/20/17 16:47:41.373]:BCA Idle Accounts Service PT:      Action: do-set-local-variable("AccountIdleFrom",scope="policy",token-xpath("jmath:max(0, $LastRunTime - 5 * 86400)")).
[06/20/17 16:47:41.374]:BCA Idle Accounts Service PT:        arg-string(token-xpath("jmath:max(0, $LastRunTime - 5 * 86400)"))
[06/20/17 16:47:41.375]:BCA Idle Accounts Service PT:          token-xpath("jmath:max(0, $LastRunTime - 5 * 86400)")
[06/20/17 16:47:41.375]:BCA Idle Accounts Service PT:            Token Value: "1497544956".
[06/20/17 16:47:41.376]:BCA Idle Accounts Service PT:          Arg Value: "1497544956".
[06/20/17 16:47:41.376]:BCA Idle Accounts Service PT:      Action: do-append-xml-text("AccountIdle/From",token-convert-time(dest-format="yyyy-MM-dd HH:mm:ss",src-format="!CTIME",token-local-variable("AccountIdleFrom"))).
[06/20/17 16:47:41.377]:BCA Idle Accounts Service PT:        arg-string(token-convert-time(dest-format="yyyy-MM-dd HH:mm:ss",src-format="!CTIME",token-local-variable("AccountIdleFrom")))
[06/20/17 16:47:41.378]:BCA Idle Accounts Service PT:          token-convert-time(dest-format="yyyy-MM-dd HH:mm:ss",src-format="!CTIME",token-local-variable("AccountIdleFrom"))
[06/20/17 16:47:41.379]:BCA Idle Accounts Service PT:            token-convert-time(dest-format="yyyy-MM-dd HH:mm:ss",src-format="!CTIME",token-local-variable("AccountIdleFrom"))
[06/20/17 16:47:41.380]:BCA Idle Accounts Service PT:              token-local-variable("AccountIdleFrom")
[06/20/17 16:47:41.380]:BCA Idle Accounts Service PT:                Token Value: "1497544956".
[06/20/17 16:47:41.380]:BCA Idle Accounts Service PT:              Arg Value: "1497544956".
[06/20/17 16:47:41.381]:BCA Idle Accounts Service PT:            Token Value: "2017-06-15 16:42:36".
[06/20/17 16:47:41.381]:BCA Idle Accounts Service PT:          Arg Value: "2017-06-15 16:42:36".
[06/20/17 16:47:41.382]:BCA Idle Accounts Service PT:      Action: do-append-xml-element("To..","AccountIdle1").
[06/20/17 16:47:41.382]:BCA Idle Accounts Service PT:      Action: do-set-local-variable("AccountIdleTo",scope="policy",token-xpath("$ThisRunTime - 5 * 86400")).
[06/20/17 16:47:41.383]:BCA Idle Accounts Service PT:        arg-string(token-xpath("$ThisRunTime - 5 * 86400"))
[06/20/17 16:47:41.384]:BCA Idle Accounts Service PT:          token-xpath("$ThisRunTime - 5 * 86400")
[06/20/17 16:47:41.384]:BCA Idle Accounts Service PT:            Token Value: "1497545261".
[06/20/17 16:47:41.385]:BCA Idle Accounts Service PT:          Arg Value: "1497545261".
[06/20/17 16:47:41.385]:BCA Idle Accounts Service PT:      Action: do-append-xml-text("AccountIdle/To..",token-convert-time(dest-format="yyyy-MM-dd HH:mm:ss",src-format="!CTIME",token-local-variable("AccountIdleTo"))).
[06/20/17 16:47:41.386]:BCA Idle Accounts Service PT:        arg-string(token-convert-time(dest-format="yyyy-MM-dd HH:mm:ss",src-format="!CTIME",token-local-variable("AccountIdleTo")))
[06/20/17 16:47:41.387]:BCA Idle Accounts Service PT:          token-convert-time(dest-format="yyyy-MM-dd HH:mm:ss",src-format="!CTIME",token-local-variable("AccountIdleTo"))
[06/20/17 16:47:41.387]:BCA Idle Accounts Service PT:            token-convert-time(dest-format="yyyy-MM-dd HH:mm:ss",src-format="!CTIME",token-local-variable("AccountIdleTo"))
[06/20/17 16:47:41.388]:BCA Idle Accounts Service PT:              token-local-variable("AccountIdleTo")
[06/20/17 16:47:41.389]:BCA Idle Accounts Service PT:                Token Value: "1497545261".
[06/20/17 16:47:41.389]:BCA Idle Accounts Service PT:              Arg Value: "1497545261".
[06/20/17 16:47:41.390]:BCA Idle Accounts Service PT:            Token Value: "2017-06-15 16:47:41".
[06/20/17 16:47:41.390]:BCA Idle Accounts Service PT:          Arg Value: "2017-06-15 16:47:41".
[06/20/17 16:47:41.391]:BCA Idle Accounts Service PT:      Action: do-set-local-variable("filter",scope="policy","(&"+"(title>="+token-convert-time(dest-format="yyyyMMddHHmmss'Z'",dest-tz="UTC",src-format="!CTIME",token-local-variable("AccountIdleFrom"))+")"+"(title<="+token-convert-time(dest-format="yyyyMMddHHmmss'Z'",dest-tz="UTC",src-format="!CTIME",token-local-variable("AccountIdleTo"))+")"+token-global-variable("UserLdapFilter")+")").
[06/20/17 16:47:41.393]:BCA Idle Accounts Service PT:        arg-string("(&"+"(title>="+token-convert-time(dest-format="yyyyMMddHHmmss'Z'",dest-tz="UTC",src-format="!CTIME",token-local-variable("AccountIdleFrom"))+")"+"(title<="+token-convert-time(dest-format="yyyyMMddHHmmss'Z'",dest-tz="UTC",src-format="!CTIME",token-local-variable("AccountIdleTo"))+")"+token-global-variable("UserLdapFilter")+")")
[06/20/17 16:47:41.395]:BCA Idle Accounts Service PT:          token-text("(&")
[06/20/17 16:47:41.395]:BCA Idle Accounts Service PT:          token-text("(title>=")
[06/20/17 16:47:41.395]:BCA Idle Accounts Service PT:          token-convert-time(dest-format="yyyyMMddHHmmss'Z'",dest-tz="UTC",src-format="!CTIME",token-local-variable("AccountIdleFrom"))
[06/20/17 16:47:41.396]:BCA Idle Accounts Service PT:            token-convert-time(dest-format="yyyyMMddHHmmss'Z'",dest-tz="UTC",src-format="!CTIME",token-local-variable("AccountIdleFrom"))
[06/20/17 16:47:41.397]:BCA Idle Accounts Service PT:              token-local-variable("AccountIdleFrom")
[06/20/17 16:47:41.398]:BCA Idle Accounts Service PT:                Token Value: "1497544956".
[06/20/17 16:47:41.398]:BCA Idle Accounts Service PT:              Arg Value: "1497544956".
[06/20/17 16:47:41.398]:BCA Idle Accounts Service PT:            Token Value: "20170615134236Z".
[06/20/17 16:47:41.399]:BCA Idle Accounts Service PT:          token-text(")")
[06/20/17 16:47:41.399]:BCA Idle Accounts Service PT:          token-text("(title<=")
[06/20/17 16:47:41.400]:BCA Idle Accounts Service PT:          token-convert-time(dest-format="yyyyMMddHHmmss'Z'",dest-tz="UTC",src-format="!CTIME",token-local-variable("AccountIdleTo"))
[06/20/17 16:47:41.400]:BCA Idle Accounts Service PT:            token-convert-time(dest-format="yyyyMMddHHmmss'Z'",dest-tz="UTC",src-format="!CTIME",token-local-variable("AccountIdleTo"))
[06/20/17 16:47:41.401]:BCA Idle Accounts Service PT:              token-local-variable("AccountIdleTo")
[06/20/17 16:47:41.402]:BCA Idle Accounts Service PT:                Token Value: "1497545261".
[06/20/17 16:47:41.402]:BCA Idle Accounts Service PT:              Arg Value: "1497545261".
[06/20/17 16:47:41.403]:BCA Idle Accounts Service PT:            Token Value: "20170615134741Z".
[06/20/17 16:47:41.403]:BCA Idle Accounts Service PT:          token-text(")")
[06/20/17 16:47:41.404]:BCA Idle Accounts Service PT:          token-global-variable("UserLdapFilter")
[06/20/17 16:47:41.404]:BCA Idle Accounts Service PT:            Token Value: "(&(objectClass=inetOrgPerson)(!(loginDisabled=true)))".
[06/20/17 16:47:41.405]:BCA Idle Accounts Service PT:          token-text(")")
[06/20/17 16:47:41.405]:BCA Idle Accounts Service PT:          Arg Value: "(&(title>=20170615134236Z)(title<=20170615134741Z)(&(objectClass=inetOrgPerson)(!(loginDisabled=true))))".
[06/20/17 16:47:41.406]:BCA Idle Accounts Service PT:      Action: do-set-local-variable("filter5555",scope="policy","(&"+"(objectClass=user)"+"(title=5555)"+")").
[06/20/17 16:47:41.407]:BCA Idle Accounts Service PT:        arg-string("(&"+"(objectClass=user)"+"(title=5555)"+")")
[06/20/17 16:47:41.407]:BCA Idle Accounts Service PT:          token-text("(&")
[06/20/17 16:47:41.408]:BCA Idle Accounts Service PT:          token-text("(objectClass=user)")
[06/20/17 16:47:41.408]:BCA Idle Accounts Service PT:          token-text("(title=5555)")
[06/20/17 16:47:41.409]:BCA Idle Accounts Service PT:          token-text(")")
[06/20/17 16:47:41.409]:BCA Idle Accounts Service PT:          Arg Value: "(&(objectClass=user)(title=5555))".
[06/20/17 16:47:41.409]:BCA Idle Accounts Service PT:      Action: do-set-local-variable("idle-attrlist",scope="policy","mail,bcaEconOperatorDN,company,title").
[06/20/17 16:47:41.410]:BCA Idle Accounts Service PT:        arg-string("mail,bcaEconOperatorDN,company,title")
[06/20/17 16:47:41.411]:BCA Idle Accounts Service PT:          token-text("mail,bcaEconOperatorDN,company,title")
[06/20/17 16:47:41.411]:BCA Idle Accounts Service PT:          Arg Value: "mail,bcaEconOperatorDN,company,title".
[06/20/17 16:47:41.412]:BCA Idle Accounts Service PT:      Action: do-clone-xpath(dest-expression="AccountIdle1",src-expression="es:bh_LdapSearch($LdapConnect, $LdapPort, $LdapUseTls, $LdapTlsKeystore, $LdapTlsStorepass, $LdapLogin, $LdapPassword, 'OU=users,O=bca', 'sub', $filter5555, $idle-attrlist, 0)").
[06/20/17 16:47:41.413]:BCA Idle Accounts Service PT:        Retrieving password value for named password 'LdapTlsStorepass'.
[06/20/17 16:47:41.422]:BCA Idle Accounts Service PT:        bh_LdapSearch: Preparing new plaintext connection.
[06/20/17 16:47:41.424]:BCA Idle Accounts Service PT:        bh_LdapSearch: Connecting to 192.168.1.167:389
[06/20/17 16:47:41.430]:BCA Idle Accounts Service PT:        bh_LdapSearch: Binding as user CN=bcaadm,OU=sa,O=system
[06/20/17 16:47:41.433]:BCA Idle Accounts Service PT:        bh_LdapSearch: Executing search.
[06/20/17 16:47:41.440]:BCA Idle Accounts Service PT:        bh_LdapSearch: Search returned 1 entries.
[06/20/17 16:47:41.440]:BCA Idle Accounts Service PT:        bh_LdapSearch: Disconnecting from server.
[06/20/17 16:47:41.441]:BCA Idle Accounts Service PT:    Evaluating selection criteria for rule 'bca Biuld Notify Superusers For Idle Accounts List'.
[06/20/17 16:47:41.442]:BCA Idle Accounts Service PT:      (if-xpath true "self::status[@type="notification"]") = TRUE.
[06/20/17 16:47:41.443]:BCA Idle Accounts Service PT:      (if-global-variable 'AccountIdle1Superuser' equal "true") = TRUE.
[06/20/17 16:47:41.443]:BCA Idle Accounts Service PT:    Rule selected.
[06/20/17 16:47:41.444]:BCA Idle Accounts Service PT:    Applying rule 'bca Biuld Notify Superusers For Idle Accounts List'.
[06/20/17 16:47:41.444]:BCA Idle Accounts Service PT:      Action: do-for-each(arg-node-set(token-xpath("AccountIdle1/instance"))).
[06/20/17 16:47:41.445]:BCA Idle Accounts Service PT:        arg-node-set(token-xpath("AccountIdle1/instance"))
[06/20/17 16:47:41.445]:BCA Idle Accounts Service PT:          token-xpath("AccountIdle1/instance")
[06/20/17 16:47:41.446]:BCA Idle Accounts Service PT:          Token Value: {<instance> @src-dn = "cn=msimeonov,ou=users,o=bca"}.
[06/20/17 16:47:41.446]:BCA Idle Accounts Service PT:          Arg Value: {<instance> @src-dn = "cn=msimeonov,ou=users,o=bca"}.
[06/20/17 16:47:41.447]:BCA Idle Accounts Service PT:        Performing actions for local-variable(current-node) = <instance> @src-dn = "cn=msimeonov,ou=users,o=bca".
[06/20/17 16:47:41.448]:BCA Idle Accounts Service PT:          Action: do-set-local-variable("CurrentBCAEconOperatorDN",scope="policy",token-xpath("attr[@attr-name='bcaEconOperatorDN']/value/text()")).
[06/20/17 16:47:41.449]:BCA Idle Accounts Service PT:            arg-string(token-xpath("attr[@attr-name='bcaEconOperatorDN']/value/text()"))
[06/20/17 16:47:41.449]:BCA Idle Accounts Service PT:              token-xpath("attr[@attr-name='bcaEconOperatorDN']/value/text()")
[06/20/17 16:47:41.450]:BCA Idle Accounts Service PT:                Token Value: "".
[06/20/17 16:47:41.450]:BCA Idle Accounts Service PT:              Arg Value: "".
[06/20/17 16:47:41.451]:BCA Idle Accounts Service PT:          Action: do-trace-message(color="white",level="3","Current notification of Superuser of EconOperator: "+token-local-variable("CurrentBCAEconOperatorDN")).
[06/20/17 16:47:41.452]:BCA Idle Accounts Service PT:            arg-string("Current notification of Superuser of EconOperator: "+token-local-variable("CurrentBCAEconOperatorDN"))
[06/20/17 16:47:41.453]:BCA Idle Accounts Service PT:              token-text("Current notification of Superuser of EconOperator: ")
[06/20/17 16:47:41.453]:BCA Idle Accounts Service PT:              token-local-variable("CurrentBCAEconOperatorDN")
[06/20/17 16:47:41.454]:BCA Idle Accounts Service PT:                Token Value: "".
[06/20/17 16:47:41.454]:BCA Idle Accounts Service PT:              Arg Value: "Current notification of Superuser of EconOperator: ".
[06/20/17 16:47:41.455]:BCA Idle Accounts Service PT:Current notification of Superuser of EconOperator: 
[06/20/17 16:47:41.455]:BCA Idle Accounts Service PT:          Action: do-append-xml-element("AccountIdle1Superuser",".").
[06/20/17 16:47:41.456]:BCA Idle Accounts Service PT:          Action: do-append-xml-element("MUHAHA","AccountIdle1Superuser").
[06/20/17 16:47:41.457]:BCA Idle Accounts Service PT:          Action: do-set-local-variable("filterForSuperuser",scope="policy","(&"+"(objectClass=user)"+"(bcaEconOperatorDN="+token-local-variable("CurrentBCAEconOperatorDN")+")"+"(bcaIsSuperUser=1)"+")").
[06/20/17 16:47:41.458]:BCA Idle Accounts Service PT:            arg-string("(&"+"(objectClass=user)"+"(bcaEconOperatorDN="+token-local-variable("CurrentBCAEconOperatorDN")+")"+"(bcaIsSuperUser=1)"+")")
[06/20/17 16:47:41.459]:BCA Idle Accounts Service PT:              token-text("(&")
[06/20/17 16:47:41.459]:BCA Idle Accounts Service PT:              token-text("(objectClass=user)")
[06/20/17 16:47:41.460]:BCA Idle Accounts Service PT:              token-text("(bcaEconOperatorDN=")
[06/20/17 16:47:41.460]:BCA Idle Accounts Service PT:              token-local-variable("CurrentBCAEconOperatorDN")
[06/20/17 16:47:41.460]:BCA Idle Accounts Service PT:                Token Value: "".
[06/20/17 16:47:41.461]:BCA Idle Accounts Service PT:              token-text(")")
[06/20/17 16:47:41.461]:BCA Idle Accounts Service PT:              token-text("(bcaIsSuperUser=1)")
[06/20/17 16:47:41.462]:BCA Idle Accounts Service PT:              token-text(")")
[06/20/17 16:47:41.462]:BCA Idle Accounts Service PT:              Arg Value: "(&(objectClass=user)(bcaEconOperatorDN=)(bcaIsSuperUser=1))".
[06/20/17 16:47:41.463]:BCA Idle Accounts Service PT:          Action: do-set-local-variable("idle-attrlistForSuperuser",scope="policy","mail").
[06/20/17 16:47:41.463]:BCA Idle Accounts Service PT:            arg-string("mail")
[06/20/17 16:47:41.464]:BCA Idle Accounts Service PT:              token-text("mail")
[06/20/17 16:47:41.464]:BCA Idle Accounts Service PT:              Arg Value: "mail".
[06/20/17 16:47:41.465]:BCA Idle Accounts Service PT:          Action: do-clone-xpath(dest-expression="AccountIdle1Superuser",src-expression="es:bh_LdapSearch($LdapConnect, $LdapPort, $LdapUseTls, $LdapTlsKeystore, $LdapTlsStorepass, $LdapLogin, $LdapPassword, 'OU=users,O=bca', 'sub', $filterForSuperuser, $idle-attrlistForSuperuser, 0)").
[06/20/17 16:47:41.466]:BCA Idle Accounts Service PT:            Retrieving password value for named password 'LdapTlsStorepass'.
[06/20/17 16:47:41.468]:BCA Idle Accounts Service PT:            bh_LdapSearch: Preparing new plaintext connection.
[06/20/17 16:47:41.468]:BCA Idle Accounts Service PT:            bh_LdapSearch: Connecting to 192.168.1.167:389
[06/20/17 16:47:41.475]:BCA Idle Accounts Service PT:            bh_LdapSearch: Binding as user CN=bcaadm,OU=sa,O=system
[06/20/17 16:47:41.477]:BCA Idle Accounts Service PT:            bh_LdapSearch: Executing search.
[06/20/17 16:47:41.479]:BCA Idle Accounts Service PT:            bh_LdapSearch: Search returned 0 entries.
[06/20/17 16:47:41.480]:BCA Idle Accounts Service PT:            bh_LdapSearch: Disconnecting from server.
[06/20/17 16:47:41.481]:BCA Idle Accounts Service PT:Policy returned:
[06/20/17 16:47:41.481]:BCA Idle Accounts Service PT:
<nds dtdversion="4.0">
  <source>
    <product instance="BCA Idle Accounts Service" version="4.5.0.0">Identity Manager Driver for eDirectory</product>
    <contact>NetIQ Corporation</contact>
  </source>
  <input>
    <status level="success" type="notification">Password Expiration Notification<br/>
<LastRunTime>2017-06-20 16:42:36</LastRunTime>
<ThisRunTime>2017-06-20 16:47:41</ThisRunTime>
<AccountIdle1>
        <From/>
        <To../>
        <instance src-dn="cn=msimeonov,ou=users,o=bca">
          <attr attr-name="bcaEconOperatorDN">
            <value>cn=EIK200417978,ou=econoperators,o=bca</value>
          </attr>
          <attr attr-name="mail">
            <value>msimeonov@intepro-bg.com</value>
          </attr>
          <attr attr-name="title">
            <value>5555</value>
          </attr>
        </instance>
      </AccountIdle1>
      <AccountIdle1Superuser>
        <MUHAHA/>
      </AccountIdle1Superuser>
    </status>
  </input>
</nds>
At the end I expect some instances in the AccountIdle1Superuser nodeset. However, if you check above the way I construct the ldap filter "filterForSuperuser", you'll notice a local variable CurrentBCAEconOperatorDN , which I need it filled with a value from AccountIdle1 nodeset - the value is cn=EIK200417978,ou=econoperators,o=bca . For whatever reasons, this variable is empty, so the ldap filter is not formed correctly, and I get an empty nodeset.

So obviously, this:
do-set-local-variable("CurrentBCAEconOperatorDN",scope="policy" ,token-xpath("attr[@attr-name='bcaEconOperatorDN']/value/text()")) - doesn't work.

I'm new to XPath, so all help is highly appreciated.

Cheers,
Milko