I am have profiles setup for all our users but I am having some trouble with the setting the groupmembership_filter correctly. It will query LDAP successfully but only after it does a failed search first. I have tried using numerous filters including the default one but I cant seem to separate the username by itself which is causing the initial search failure. I read through the rlm_ldap doc a few times but I didn't seem anything that I thought would help. Here is the output from radius -X This is the part where it uses the search filter and fails. [files] users: Matched entry DEFAULT at line 214 [domain1] Entering ldap_groupcmp() [files] expand: ou=radius,o=domain.on.ca,dc=placeholder,dc=ca -> ou=radius,o=domain.on.ca,dc=placeholder,dc=ca [files] expand: (&(objectClass=radiusProfile)(member=%{control:Ldap-UserDn})) -> (&(objectClass=radiusProfile)(member=uid\3d112boy\2cou\3dradius\2co\3ddomain.on.ca\2cdc\3dplaceholder\2cdc\3dca)) [domain1] ldap_get_conn: Checking Id: 0 [domain1] ldap_get_conn: Got Id: 0 [domain1] performing search in ou=radius,o=domain.on.ca,dc=placeholder,dc=ca, with filter (&(cn=residential_profile)(&(objectClass=radiusProfile)(member=uid\3d112boy\2cou\3dradius\2co\3ddomain.on.ca\2cdc\3dplaceholder\2cdc\3dca))) [domain1] object not found It starts a second search and succeeds. [domain1] ldap_release_conn: Release Id: 0 [domain1] ldap_get_conn: Checking Id: 0 [domain1] ldap_get_conn: Got Id: 0 [domain1] performing search in uid=112boy,ou=radius,o=domain.on.ca,dc=palceholder,dc=ca, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group residential_profile [domain1] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 222 ++[files] returns ok My users file looks like this. ldap domain1 { server = " ldap01.placeholder.ca" identity = "username xxx" password = xxxx basedn = "ou=radius,o=domain.on.ca,dc=placeholder,dc=ca" filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=posixAccount)(cn=true))" groupname_attribute = cn groupmembership_attribute = radiusGroupName groupmembership_filter = "(&(objectClass=radiusProfile)(member=%{control:Ldap-UserDn}))" #do_xlat = yes #compare_check_items = yes #access_attr_used_for_allow = yes ldap_connections_number = 5 My users file DEFAULT Service-Type == Framed-User, Huntgroup-Name == bras, domain1-Ldap-Group == residential_profile Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair += "ip:inacl#100=permit tcp any x.x.0.16 0.0.0.15 eq 25", Cisco-AVPair += "ip:inacl#200=deny tcp any any eq 25", Cisco-AVPair += "ip:inacl#300=permit ip any any", Fall-Through = No Any help is apprecaited. Thanks, Chris