ACL Blacklist

[Richard Moon <richard.moon@netcentrica.com>]

Could anyone give me advice on implementing blacklists, the following
does not seem to work :

access	to attr=userPassword
	by dn="uid=testuser,ou=people,dc=mydomain,dc=com" none
	by self read
	by * auth

access 	to * 
	by * read


I'd like to replace 

by dn="uid=testuser,ou=people,dc=mydomain,dc=com" none

with

by group="ou=blacklist,ou=people,dc=mydomain,dc=com" none

but I can't get the basics to work - I've seen postings on whitelist
access for admin staff but nothing on denying access based on
groupOfNames.

RM