I believe it an option to access the matched DN string should be provided. Besides the obvious symettry with LDAP_OPT_ERROR_STRING, access to LDAP_OPT_MATCHED_DN may be needed to implement extensions to the API. Kurt