agentService.properties contains help for the Privileged Attribute Mapping that has example mappings that contain incorrect DNs:
id=manager,ou=group,dc=openam,dc=forgerock.dc=org
Note the .dc=org rather than ,dc=org, should be:
id=manager,ou=group,dc=openam,dc=forgerock,dc=org
This is since changes as part of AME-52 and AME-129, see https://stash.forgerock.org/projects/OPENAM/repos/openam/commits/9fa57a4f31580310b62bb2f08906e6b73d510817#openam-server/src/main/resources/locale/agentService.properties