Hi, I'd like to forbid authentication of users without encryption. It's possible to use sockurl in the ACL's : access to attr=userpassword by sockurl="^ldap:///$" none by sockurl="^ldaps:///$" break This makes the difference between port 389 and 636. But how could I specify that access to port 389 with STARTTLS is also acceptable ? Patrick