If your default realm was APACHE.ORG, but you also wanted to take all principals from ACME.COM that had a single component joe@ACME.COM, the following rule would do this:

RULE:[1:$1@$0](.@ACME.COM)s/@.//

DEFAULT

To translate names with a second component, you could use these rules:

RULE:[1:$1@$0](.@ACME.COM)s/@.//

RULE:[2:$1@$0](.@ACME.COM)s/@.// DEFAULT

To treat all principals from APACHE.ORG with the extension /admin as admin, your rules would look like this:

RULE[2:$1%$2@$0](.%admin@APACHE.ORG)s/./admin/

DEFAULT