hi, maybe just luck at the time of query? you can query the LDAP as Shibboleth does . the order of the affiliation has no meaning, and should not be used to determine anything. Primary affiliation (ePPA) has its own attribute if you need to communicate the users primary role (be that staff, student etc.....) - if you are able to do that.... alan