Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-RT-Original-Encoding: iso-8859-1 Content-Length: 517 HI! I'm looking closer at the attribute type descriptions in kerberos.schema (schema file for OpenLDAP shipped by openSUSE package krb5-plugin-kdb-ldap-1.13-154.2.x86_64). For some attribute types with IA5Syntax there's defined: SUBSTR caseExactSubstringsMatch IMHO this is wrong. It has to be: SUBSTR caseExactIA5SubstringsMatch The change should not have any negative impact because substring search does not work at all when using SUBSTR caseExactSubstringsMatch with a IA5String syntax. Ciao, Michael.