Hello, I have search the archives and google, and there seems to be lots of confusion on the subject: Requiring membership to and LDAP group to authenticate. I can seem to get it to work. Notice the misspelling og the member: dn: cn=radius_wifi,ou=Groups,dc=fu,dc=bar cn: min_radius_wifi objectClass: groupOfNames objectClass: top member: cn=tes guest,ou=Guests,dc=fu,dc=bar The real user, cn=test guest,ou=Guests,dc=fu,dc=bar, is still able to login. FreeRadius Version: freeradius-1.0.1 ldap { server = "localhost" identity = "uid=authman,dc=fu,dc=bar" password = XXXXXXX basedn = "dc=fu,dc=bar" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=person)" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #` access_attr = "uid" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "cn=radius_wifi,ou=Group,dc=fu,dc=bar" timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = no } Thank you for the help, Dan