I have a freeradius box (version 1.1.0) with the following (working) group lookup.. On updating to 1.1.6 it appears the %{Stripped-User-Name:-%{User-Name}} part is broken.. I see in cvs there is an update to head, "radiusd/src/main/xlat.c (1.115): make ':-' work again".. I have not had luck trying to merge relevant changes to the 1.1 branch.. Could this be fixed in stable? -- radiusd.conf: ldap { ... gid = %{ldap:ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectClass=%{Realm}))} groupname_attribute = cn groupmembership_filter = "(&(objectClass=posixGroup)(|(gidNumber=${gid})(memberUid=%{Stripped-User-Name:-%{User-Name}})))" do_xlat = yes ... } Debugging output: rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=domain,dc=com' radius_xlat: Running registered xlat function of module ldap for string 'ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=%{Stripped-User-Name' rlm_ldap: - ldap_xlat radius_xlat: 'ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=domain,dc=com, with filter (&(uid= rlm_ldap: ldap_search() failed: Bad search filter: (&(uid= rlm_ldap: Search returned error rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=domain,dc=com, with filter (&(cn=dial1)(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))) rlm_ldap: ldap_search() failed: Bad search filter: (&(cn=dial1)(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))) rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error Thanks, -Mike