Apparently there are a number of LDAP directories that allow one to search for something like: (member=cn=userA,ou=*), where member is an attribute with DN syntax. I'm not aware of a substring matching rule that allows this, is there one? Thanks. Jim