Isn' t USERDN a full user's DN (like uid=xani,ou=users,dc=root,dc=example,dc=com) tho? I need to match only uid part as group entries in POSIX group is just a series of bare UIDs without full DN (like for that example it would be memberUid=xani). Basically I need to - extract uid from user's DN. - match group entries where memberUid=extracted uid _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx