to be a bit more specific, what i am not seeing is another bind request to AD that looks like this: ----------- Lightweight Directory Access Protocol LDAP Message, Bind Request Message Id: 1 Message Type: Bind Request (0x00) Version: 3 DN: CN=Lastname\, Firstname,OU=Users-BLAH-BLAH,OU=BLAH2,DC=XYZ,DC=ABC,DC=com Auth Type: Simple (0x00) Password: user's password that i provided in the browser ----------- ...followed by a successful response from AD. it seems that the initial response to a search query that it got back from AD is unsatisfactory, so it does not even try to bind with the newly found name. any ideas why this is happening? i even tried some other products (not apache) where AD auth works, and their network capture looks just like apache's, except they also do the second bind. any pointers/suggestions are appreciated. thank you. --------------------------------------------------------------------- The official User-To-User support forum of the Apache HTTP Server Project. See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx