A filter of the form (ou:dn:=people) should match the following entries:
- any entry having an attribute "ou" whose value is "people"
- any entry having a DN containing an AVA of the form "ou=people".
Currently, the JE backend mishandles extensible filters of this form and will use attribute indexes if available. If there is no attribute index available then the candidate list defaults to allIDs, which is ok. If there is an attribute index available then it will use it and only find entries fulfilling the first category above.
The only feasible way we have today of processing this type of filter is to always default to allIDs.
The fix is pretty straightforward.