I'm top-posting because you did. But in the future, if you put your comments in-line, it will be easier to follow the thread. I'm just too lazy to fix it all...

We're authenticating against AD in a Win2K server environment just fine. Here's part of my authldaprc

LDAP_URI ldap://dc1.eyecarenow.domain, ldap://dc2.eyecarenow.domain LDAP_PROTOCOL_VERSION 3 LDAP_BASEDN DC=eyecarenow,DC=domain LDAP_BINDDN ****user account******@eyecarenow.domain LDAP_BINDPW *****valid password******* LDAP_TIMEOUT 5 LDAP_AUTHBIND 1 LDAP_MAIL mail LDAP_MAILROOT /var/quica/domains/eyecarenow.com LDAP_HOMEDIR sAMAccountName LDAP_GLOB_UID mailuser LDAP_GLOB_GID mailuser LDAP_FULLNAME name LDAP_TLS 0

Some points that may help: 1. I did NOT use SSL. We had a problem getting it to work with the kerberos libraries, or at least that's what I was told was the problem. We created a VLAN that only has a NIC in the DCs and the mail server to increase security as best as we could. 2. This places all mail in /var/quica/domains/eyecarenow.com/**username**/Maildir If you don't use quica to manage separate MySQL logins, you'll probably want to change this to something else. 3. We had to specify binddn, bindpw, AND authbind. 4. In AD, make sure you set the email address for every user. There are other ways to set this up, but this is the way we chose, so we can host multiple domains (most in MySQL, only one in AD). 5. As you can see, our domain is 'eyecarenow.domain', so you'll need to change this to whatever your configuration is.

Hope this helps, David

Renato Otranto Jr. wrote: