As can be seen in
https://github.com/camptocamp/puppet-openldap/blob/82f3bd04b006e3c5816d5533d95cb8fd61eb7e46/lib/puppet/type/openldap_database.rb#L210
the module uses \S+ to verify the dn of a group to set a limit. \S matches any non-whitespace character, but it is perfectly allowed to use whitespaces in LDAP DNs, like cn=directory administrators, .... In order to allow such groups, the regexp has to be fixed.