Object GUID is binary IIRC, so you need to tell the LDAP connector to "do the right thing". Something like: <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid objectGUID"/> I think, but Daniel will correct me... Rod