On 06/02/12 15:53, Cornelius Kölbel wrote: > ... but it seems that the ldap_groupcmp does not support pattern matching? > Am I right or does anybody has another idea? Ldap-Group isn't a "real" attribute. It is a virtual attribute, that triggers a search in the directory when you compare to it. So you can't do this.