This morning I'm attempting to upgrade my FreeRadius install from 1.1.7 to 2.0.5. I'm having an issue with LDAP group-checking. Here's my scenario: I authenticate users with LDAP (eDirectory). In addition, I do some LDAP group-checking to determine which RADIUS attributes I want to return to the network device. This happens in the "users" file, with lines like: DEFAULT Ldap-Group == students Aruba-User-Role = student DEFAULT Ldap-Group == employees Aruba-User-Role = employee This was working in 1.1.7. But now I'm on 2.0.5, and after converting the config files, this is how it is behaving: users: Matched entry DEFAULT at line 13 rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=person)(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.messiah.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radius2/etc/raddb/certs/messiah-ca.crt rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=ldap-radius,o=mc/*** to ldap.messiah.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in t=mc-tree, with filter (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=students)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group students not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=employees)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group employees not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() ++[files] returns ok I can see the issue here... the filter is messed up. expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) The search filter should contain something like (member=cn=georget,ou=student,o=mc), but instead it has (member=). Is %{Ldap-UserDn} not correct? I got it right out of the sample configuration... Jason