Hi. Out of curiosity, which objects does the ldap module check for checkitems and replyitems? Only the object that identifies the user and the object pointed to by User-Profile? I mapped a seeAlso attribute in ldap.attrmap but I don't see it being pulled from a group object the user is matched against. thanks mk