> You are absolutely correct. irfAuthorizedService is an ldap > attribute not resolved. Then just export it. > I have now made a scripted attribute that checks if > irfAuthorizedService contains shibAdmin and it works now That is doubly overkill. -- Scott