testing a wildcard dn match