>(|(&(objectClass=group)(member=/var/log/radiusdap-UserDn}))(&(objectClass=top)(uniquemember=))) This is obviously wrong you have a typo somewhere. Probably you have: %Ldap-UserDN You should have: %{Ldap-UserDN} -- Sent from my phone. Please excuse brevity and typos.