Pierangelo Masarati wrote: Pierangelo, the objects are inetOrgPerson objects, the full object looks like this # robb(a)example.org, sql.example.org dn: uid=robb(a)example.org,dc=sql,dc=example,dc=org objectClass: inetOrgPerson cn: Robert Brooks uid: robb(a)example.org mail: robb(a)example.org I believe the only required attribute for such an object is cn. A similar search against a non back-sql part for the tree (see below) does not show an error ldapsearch -x -b "ou=people,dc=example,dc=org" "cn=Robert Brooks" dn cn objectclass # robb, people, example.org dn: uid=robb,ou=people,dc=example,dc=org cn: Robert Brooks objectClass: account objectClass: posixAccount objectClass: shadowAccount Unfortunately seems some software doesn't understand it doesn't need to request dn explicitly hence I noticed this. Let me know what you'd like, I thought this one may well reproduce on any back-sql, so didn't spray the ITS with extraneous information. Regards, Rob -- Robert Brooks, Network Manager, Cable & Wireless UK <robb(a)wtg.cw.com&gt; http://wtg.cw.com/ Tel: +44 (0)20 7339 8600 Fax: +44 (0)20 7339 8601 - "What was your username again?" - BOFH -