Sorry for sending anothe bugreport, but I found the following in the documentation of rlm_ldap (/usr/share/doc/packages/freeradius-server- doc/rlm_ldap for me): NOTE: As LDAP is case insensitive, you should probably also set "lower_user = yes" and "lower_time = before" in main section of radiusd.conf, to get limits on simultaneous logins working correctly. Otherwise, users will be able get large number of sessions, capitalizing parts of their login names. However, these options (e.g. lower_user) don't seem to exist in freeradius 2.x.x. You should replace this section with a description of how to emulate this behaviour with unlang. Regards, Németh Tamás