Hello, I've sent a pull request to add the initial support of MVA operators. This add 4 new operators to perform basic comparison with multivalued attributes * |== At least one attribute should equal the value * &== All attributes should equal the value * |=~ At least one attribute should match the regular expression * &=~ All attributes should match the regular expression The allowed syntax are attribute-name &==/|== "double quoted string with xlat expansion" attribute-name &==/|== 'single quoted string for a fixed value' attribute-name &=~/|=~ /regular expression/flag With the regexp, we're not matching against group. It will not populate the %{0} %{1} variables Their inverse is not available. Simply encapsulate their call inside !() For example, this will allow to simply check ldap-group with unlang without building a foreach loop or using huntfile. Arran is in the process to add this feature to rlm_ldap. With those operators, it would also make sense to retrieve all values with sql/ldap xlat. But this is to be discussed. The code has been tested here and it performs well. I tried to make it as clean as possible. What's left to do is update the unlang man page and the wiki. Well, if it is merged :) Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier@heliosnet.org