Hi, JFYI. I improved the user-auth and customer-auth ldap interface with 'UserAttr' ("UID" for posixGroups objectclass and "DN" for non posixGroups objectclass) on group access check (cvs head). Config options now: [...] $Self->{'AuthModule::LDAP::GroupDN'} = 'cn=otrsallow,ou=posixGroups,dc=example,dc=com'; $Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid'; # for ldap posixGroups objectclass (just uid) $Self->{'AuthModule::LDAP::UserAttr'} = 'UID'; # for non ldap posixGroups objectclass (with full user dn) $Self->{'AuthModule::LDAP::UserAttr'} = 'DN'; [...] Martin -- Martin Edenhofer - <martin at edenhofer.de> - http://martin.edenhofer.de/ -- Noch 174 Tage bis zum Gäubodenvolksfest! ;-)