[...] val.regex="/bin/[^f][^s][^h]"
It will match "/bin/bash" (that's ok), it will NOT match "/bin/fsh" (also ok), but it will also NOT match "/bin/ash" or "/bin/foo".
Good point. Fortunately for us, I think this pattern works for all shells currently used in our environment. I tried a negative lookahead, which is what I really want, but slapd complained about the syntax.
Mark