Distinguished names (DNs) in a directory service allow literal unescaped asterisks in the DN string. For instance, the following could be the DN of an object in the University's Active Directory system:

CN=jbn adsadasda2,OU=*,OU=test\,\+\"\;\<\>,OU=J.B. Nicholson,OU=FC Computers,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu

The deepest-level OU is named * (OU=*) and that asterisk is listed in the DN without being escaped. This is consistent with RFC 2253 section 2.4, the standard description of a distinguished name concerning escaping characters in the DN string. The standard allows, but does not require, escaping asterisks (“Implementations MAY escape other characters.”).¹⁾

Martinet extends DNs via a simple and terse wildcard syntax so that IT Professionals can quickly match multiple directory service objects in certain sections (such as group sections). Thus Martinet needs a way to distinguish between a literal asterisk and an asterisk wildcard. Therefore, Martinet uses a literal asterisk when that doesn't conflict (such as Active Directory Users & Computers (ADUC) references and DNs with asterisks in a directory object name) and an escaped asterisk where a conflict exists (sections that take ADUC references and DNs where one wants to indicate multiple directory service objects):

Internally, Martinet translates Active Directory Users & Computers (ADUC) references into DNs. Therefore ADUC asterisks representing wildcards must also be escaped.