Behaviour of multiple sequenced authorization modules ?

I would like to have multiple authorization modules invoked and then reject if ANY do NOT authorize ? For instance.. authorize { ldap1 ldap2 } It appears if just one returns OK, then the subsequent authentication works. BTW.. The subsequent authentication is actually a PEAP/MSCHAPV2... Therefore, the ldap modules are ONLY used for authorization... Is there somewhere that discusses the various options on how to control the behaviour when multiple authorization modules are involved ? Thanks, Robert Robert Roll Computer Professiona University of Utah Robert.Roll@utah.edu