Take the default supplied config. Add ldap to the authorize section in default and inner-tunnel, and to the authenticate section of both. Add your AP into clients.conf. now edit the ldap module to your requirements That should work pretty much as is Rinse, repeat. Ie now edit other things to optimise , looking at the debug output AFTER EACH CHANGE to see what's needed and whats not..set PEAP as default type in EAP.conf rather than md5 etc alan -- This smartphone has free worldwide WiFi access using eduroam. Now. that IS smart.