When you create an ACL entry for an LDAP group, you must provide the Distinguished Name (DN) of the LDAP directory for the createAclEntry principalName field.
A DN is a sequence of relative distinguished names (RDN) connected by commas. An RDN is an attribute with an associated value in the form attribute=value; normally expressed in a UTF-8 string format.
ectool createAclEntry group "CN=ec-admins,OU=user,OU=Groups,DC=eflow,DC=net" --systemObjectName server
The DN is
"CN=ec-admins,OU=user,OU=Groups,DC=eflow,DC=net". This command will create an ACL group called ec-admins on the server. The location of the LDAP directory is eflow.net/user/Groups.