Basically attrs=entry can be viewed as granting access to the DN OR it can be viewed a granting access to the container which holds the entry, it's name, and it's attributes. However, attrs=entry by itself doesn't grant access to any attributes. It's currently only applicable to the search operation. Kurt