Reading  and  I can't seem to find how to grant an object the
right to execute the getEffectiveRights extended operation. At this
time I seem to only be able to carry this out with Directory Manager.
What aci is needed to allow some groupdn access to the GER operation?