kevin <kevinsmbox at earthlink.net> wrote: > The reason that I want to put it to post-auth is that it should be done > only for authenticated users. > That's why I cannot use "users". If the user is rejected, all attributes are stripped from the response. You *can* use "users". Everyone else does. Alan DeKok.