The Auto Membership plug-in should use slapi_sdn_compare() for DN comparisons instead of strcmp(). This will ensure that normalized DN's are used and the comparison results are correct.
Created attachment 493636 [details] Patch
Pushed to master. Thanks to Rich and Noriko for their reviews! Counting objects: 13, done. Delta compression using up to 2 threads. Compressing objects: 100% (7/7), done. Writing objects: 100% (7/7), 1.30 KiB, done. Total 7 (delta 4), reused 0 (delta 0) To ssh://git.fedorahosted.org/git/389/ds.git 006083a..16f3ead master -> master