The current ldap module gives a warning: [ldap] performing user authorization for user1 [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) ->(uid=user1) Shouldn't it be: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Norbert Wegener