matthew, these fields are clear-text equivalent, and are a) in clear-text in the ldap database b) transmitted over-the-wire in the clear. this needs to be resolved before this code can go into production. luke