hyc(a)OpenLDAP.org wrote: As I note in the added comment, the check_password interface kinda sucks here. Instead of making the external module malloc its error message string, we should have passed in a struct berval with a buffer and length(buffer) already set. I'd like to change this for 2.5, it will also simplify ITS#6082. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/