On 05/13/2011 07:34 PM, Herbert Fischer wrote: > if (ldap_group-LDAP-Group != "somegroup") { You can't do this. You can only test for group membership i.e. if (ldap_group-LDAP-Group == somegroup) { # do nothing } else { # ...whatever } The != and other operators don't work for the virtual attribute "LDAP-Group"