Hi Alan, just to let you know: if (NAS-Identifier == "%{ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)}" ) { ok } message: ++? if (NAS-Identifier == "%{ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)}" ) rlm_ldap: - ldap_xlat expand: cn=%{User-Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices) -> cn=testuser,ou=Users,dc=marcolinux,dc=local (eckAllowedServices) rlm_ldap: String passed does not look like an LDAP URL. expand: %{ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)} -> it seems to me that it "fires" the ldap module but it don't like my syntax. the same is for if (NAS-Identifier == "%{ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local}" ) { ok } ++? if (NAS-Identifier == "%{ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local}" ) rlm_ldap: - ldap_xlat expand: cn=%{User-Name},ou=Users,dc=marcolinux,dc=local -> cn=testuser,ou=Users,dc=marcolinux,dc=local rlm_ldap: String passed does not look like an LDAP URL. I do not understand why the message complains about LDAP URL - ldap URL is the address of the server - what I provided is an LDAP DN I tought it is not necessary to supply the LDAP URL because they are already provided in modules/ldap file Now I'm sure I have undestood absolutely nothing about this module Marco