Hello, In testing our merge of 3.0.4 RC1 it seems that rlm_ldap_groupcmp() is no longer invoked to check group membership when evaluating unlang conditionals and instead always returns FALSE. Previously, in 3.0.1, when freeradius parsed our policy.d/user-filter unlang generated (output culled from "freeradius -fxx -l stdout"): (7) ? if (control:ldap-psec-Ldap-Group == "Professors") (7) Searching for user in group "Professors" rlm_ldap (ldap-psec): Opening additional connection (7) <<details omitted>> (7) ? if (control:ldap-psec-Ldap-Group == "Professors") -> TRUE Now I never see "Searching for user in group", but rather simply: (8) ? if (control:ldap-psec-Ldap-Group == "Professors") (8) ? if (control:ldap-psec-Ldap-Group == "Professors") -> FALSE Running under gdb, a breakpoint set on rlm_ldap_groupcmp is never hit. Any ideas? Kevin Wasserman Painless Security, LLC --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com