I would like to use LDAP to be able to authorize a user so if there have a certain attribute I can return a radius AVP with a VLAN ID in the access-accept. This would be used for allowing access to licensed library resources. However, I am not sure if I can do this the way my LDAP stuff is set up. The attribute that has the data I need is multi-valued. - StudentAA, StudentDBRN, and StudentFLNT (continuing and incoming students regardless of enrollment; includes detached study); - EnrolledStudentAA, EnrolledStudentDBRN, EnrolledStudentFLNT (enrolled in at least one credit hour for ""current"" term; next term information is used during gap between terms) - AlumniAA, AlumniDBRN, AlumniFLNT (any person who has completed at least one semester in a degree-granting program) - FacultyAA, FacultyDBRN, FacultyFLNT (defined as academic, instructional, and research appointments; includes emeritus faculty) - RegularStaffAA, RegularStaffDBRN, RegularStaffFLNT (current appointment with a status of active, suspended, short-work break, leave, or paid leave); - TemporaryStaffAA, TemporaryStaffDBRN, TemporaryStaffFLNT (current appointment with a status of active, suspended, short-work break, leave, or paid leave) - Retiree (retired from any U-Mcampus, regardless of other appoints that may still be active) - SponsoredAffiliateAA, SponsoredAffiliateDBRN, SponsoredAffiliateFLNT (has at least one departmental sponsorship). However, only 5 of them (StudentAA, EnrolledStudentAA, FacultyAA, RegularStaffAA and TemoraryStaffAA) should get the radius AVP and be allowed access. However, when I query I get something like the following ldapsearch -h ldap.umich.edu -ZZ -z0 -x -D <cut> -b ou=people,dc=umich,dc=edu -LLL -s sub uniqueid=<username> umichinstroles dn: uid=<username>,ou=People,dc=umich,dc=edu umichinstroles: RegularStaffAA umichinstroles: AlumniFLNT So that is not really a group membership. Is this something I will be able to do? If I can not do it natively can folks mention other options/solutions? ------------------------ ------------------------ Walter Reynolds Principal Systems Security Development Engineer Information and Technology Services University of Michigan (734) 615-9438