Hi Matthias, Please correct me if I am wrong, but in my understanding, DNs like "=,cn=users,dc=bla,dc=com" are just invalid DNs. Why we should handle this case in a module rather than in the DN validate implementation? -- CU, Kamen Mazdrashki