Hi, is there a way in openldap to define limits (search result size limits) for the members of a group and the members of sub groups of that group recursively (i.e. something like the setspec syntax for acls)? for acls the recursion could be done via: access to dn.subtree="ou=branch1,dc=organization,dc=com" by set="[cn=chiefcommanders,ou=groups,dc=organization,dc=com]/member* & user" manage the "group[/oc[/at]]=<pattern>" form what I understand does not allow to recursively resolve members of sub groups. Thanks, Marvin