Here are improvements: 1) Instead of matching against an individual attribute, match against a set of values returned by an LDAP URI: ftp://ftp.openldap.org/incoming/manu-070918.patch 2) a man page for slapo-constraint(5) ftp://ftp.openldap.org/incoming/manu-pkg-070919.tgz -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu@netbsd.org