I've configured my server to successfully authenticate against AD using my ldap module. However, my users are in multiple OUs, and I can only specify one basedn at a time. I know that's probably not good directory structure, but I don't manage our directory. What approach to others use to search multiple basedns? In case it would help, here is the relevant portions from my ldap module, which is curently working (I've remved most comments to make it concise: ldap { server = xxx identity = "cn=ldapuser,ou=service accounts,dc=cphc,dc=local" password = xxx basedn = "dc=cphc,dc=local" ***This doesn't work without a specific OU. My users are in multiple OUs**** #basedn = "OU=CHA-Staff (No Folder Redir),DC=cphc,DC=local" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(member=%{check:Ldap-UserDn})" groupmembership_attribute = member #compare_check_items = yes #do_xlat = yes access_attr_used_for_allow = yes } *One thing that confuses me is that ldapsearch works fine using basedn="dc=cphc,dc=local". Any my error output: [ldap] performing user authorization for jpjohnson [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=jpjohnson) [ldap] expand: dc=cphc,dc=local -> dc=cphc,dc=local rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to tch-nt2.cphc.local:389, authentication 0 rlm_ldap: bind as cn=ldapuser,ou=service accounts,dc=cphc,dc=local/xxx to tch-nt2.cphc.local:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=cphc,dc=local, with filter (sAMAccountName=jpjohnson) rlm_ldap: ldap_search() failed: Operations error [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail -Jeff