Hey Hallvard,
thanks for your prompt response. My big concern is that at the time of search I am not aware of the ldap tree structure. In other words, I only know about root, project, and site1, and dont have any info about rest of the tree (existence of site 2 etc). Perhaps I can do one search for excluded sites like site2, and use the result to return appropriate users. this should be possible as I am using jLDAP to connect to ldap directory from my java code. I would like to do one query though.....not sure if it is possible!