Troy Knabe wrote: Usually requirements like this are handled by X.500 DIT Structure Rules but we don't yet support them in OpenLDAP. Instead, use a recent 2.4 release and look at AddContentACLs - only give write permission for Adds if the correct value is present in the objectclass attribute. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/