Another option, at least for OpenLDAP 2.2, is to write a SLAPI pre- operation bind plugin that performs the necessary authentication. -- Luke -- Luke Howard | PADL Software Pty Ltd | www.padl.com