In your last response stating you still had problems with "by auth *" denying access, I note that the log you provided is for a search operation. The client needs more than "auth" access to perform search operation. Kurt