Use TR_LIST for domain/realm constraint matches