--- src/modules/rlm_ldap/rlm_ldap.c	2006-04-08 15:12:28.000000000 +0100
+++ src/modules/rlm_ldap/rlm_ldap.c	2006-04-08 15:17:17.000000000 +0100
@@ -248,6 +248,7 @@
 struct TLDAP_RADIUS {
 	char*                 attr;
 	char*                 radius_attr;
+	LRAD_TOKEN            operator;
 	struct TLDAP_RADIUS*  next;
 };
 typedef struct TLDAP_RADIUS TLDAP_RADIUS;
@@ -657,6 +658,8 @@
 	/* all buffers are of MAX_LINE_LEN so we can use sscanf without being afraid of buffer overflows */
 	char buf[MAX_LINE_LEN], itemType[MAX_LINE_LEN], radiusAttribute[MAX_LINE_LEN], ldapAttribute[MAX_LINE_LEN];
 	int linenumber;
+	LRAD_TOKEN operator;
+	char opstring[MAX_LINE_LEN];
 
 	/* open the mappings file for reading */
 
@@ -688,23 +691,39 @@
 		if (buf[0] == 0) continue;
 
 		/* extract tokens from the string */
-		token_count = sscanf(buf, "%s %s %s", itemType, radiusAttribute, ldapAttribute);
+		token_count = sscanf(buf, "%s %s %s %s", itemType, radiusAttribute, ldapAttribute, opstring);
 
 		if (token_count <= 0) /* no tokens */
 			continue;
 
-		if (token_count != 3) {
-			radlog(L_ERR, "rlm_ldap: Skipping %s line %i: %s", filename, linenumber, buf);
-			radlog(L_ERR, "rlm_ldap: Expected 3 tokens "
-			       "(Item type, RADIUS Attribute and LDAP Attribute) but found only %i", token_count);
+		if ((token_count < 3) || (token_count > 4)) {
+			radlog(L_ERR, "rlm_ldap: Skipping %s line %i: %s",
+					filename, linenumber, buf);
+			radlog(L_ERR, "rlm_ldap: Expected 3 to 4 tokens "
+					"(Item type, RADIUS Attribute and LDAP Attribute) but found only %i", token_count);
 			continue;
 		}
+		
+		if (token_count == 3) {
+			operator = T_INVALID; /* use defaults */
+		} else {
+			char *ptr;
+			
+			ptr = opstring;
+			operator = gettoken(&ptr, buf, sizeof(buf));
+			if ((operator < T_OP_ADD) || (operator > T_OP_CMP_EQ)) {
+				radlog(L_ERR, "rlm_ldap: file %s: skipping line %i: unknown or invalid operator %s",
+						filename, linenumber, opstring);
+				continue;
+			}
+		}
 
 		/* create new TLDAP_RADIUS list node */
 		pair = rad_malloc(sizeof(TLDAP_RADIUS));
 
 		pair->attr = strdup(ldapAttribute);
 		pair->radius_attr = strdup(radiusAttribute);
+		pair->operator = operator;
 
 		if ( (pair->attr == NULL) || (pair->radius_attr == NULL) ) {
 			radlog(L_ERR, "rlm_ldap: Out of memory");
@@ -2312,7 +2331,8 @@
 	TLDAP_RADIUS   *element;
 	LRAD_TOKEN      token;
 	int             is_generic_attribute;
-	char            value[256];
+	char           *value;
+	char		buf[MAX_STRING_LEN];
 	VALUE_PAIR     *pairlist = NULL;
 	VALUE_PAIR     *newpair = NULL;
 
@@ -2332,7 +2352,7 @@
 			vals_count = ldap_count_values(vals);
 
 			for (vals_idx = 0; vals_idx < vals_count; vals_idx++) {
-				ptr = vals[vals_idx];
+				value = ptr = vals[vals_idx];
 
 				if (is_generic_attribute) {
 					/* this is a generic attribute */
@@ -2348,13 +2368,20 @@
 						       element->attr, vals[vals_idx]);
 					}
 				} else {
-					/* this is a one-to-one-mapped attribute */
-					token = gettoken(&ptr, value, sizeof(value) - 1);
+					token = gettoken(&ptr, buf, sizeof(buf) - 1);
 					if (token < T_EQSTART || token > T_EQEND) {
-						token = (is_check) ? T_OP_CMP_EQ : T_OP_EQ;
+						/* no leading operator found */
+						if (element->operator != T_INVALID)
+							token = element->operator;
+						else if (is_check)
+							token = T_OP_CMP_EQ;
+						else
+							token = T_OP_EQ;
 					} else {
-						gettoken(&ptr, value, sizeof(value) - 1);
+						/* the value is after the operator */
+						value = ptr;
 					}
+					
 					if (value[0] == 0) {
 						DEBUG("rlm_ldap: Attribute %s has no value", element->attr);
 						break;