Hi, Is there some way to configure ldap at radius to read only object classes and not groups? To allow or reject the access to some destination? Eg. groupname_attribute = cn groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{User-Name})(objectclass=brEduPerson))” Is there some way to configure ldap at radius to read only object classes and not groups? To allow My LDAP server does not have groups, so I can’t use the above… how can I get some object classes? Instead of groups? Like (search logs in debug down): uid=69327181034 brEduAffiliation brEntranceDate: 20091008 brEduAffiliation: 1 brEduAffiliationType: employee objectClass: brEduPerson uid=02494605059 brEduAffiliation=1 brEntranceDate: 20120110 brEduAffiliation: 1 brEduAffiliationType: student objectClass: brEduPerson The search returns this: Wed Dec 11 14:18:44 2013 : Info: +- entering group post-auth {...} Wed Dec 11 14:18:44 2013 : Info: ++? if (LDAP-Group == "student") Wed Dec 11 14:18:44 2013 : Debug: [ldap] Entering ldap_groupcmp() Wed Dec 11 14:18:44 2013 : Info: expand: ou=people,dc=DOMAIN,dc=EDU -> ou=people,dc=DOMAIN,dc=EDU Wed Dec 11 14:18:44 2013 : Info: expand: (&(objectClass=posixGroup)(memberUid=%{User-Name})(objectclass=brEduPerson)) -> (&(objectClass=posixGroup)(memberUid=74879995053)(objectclass=brEduPerson)) Wed Dec 11 14:18:44 2013 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Dec 11 14:18:44 2013 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Dec 11 14:18:44 2013 : Debug: [ldap] performing search in ou=people,dc=DOMAIN,dc=EDU, with filter (&(cn=student)(&(objectClass=posixGroup)(memberUid=74879995053)(objectclass=brEduPerson))) Wed Dec 11 14:18:44 2013 : Debug: [ldap] object not found Wed Dec 11 14:18:44 2013 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Dec 11 14:18:44 2013 : Debug: rlm_ldap::ldap_groupcmp: Group student not found or user is not a member. Wed Dec 11 14:18:44 2013 : Info: ? Evaluating (LDAP-Group == "student") -> FALSE Thank You