yeah, me neither. I see from the logs it attempts a bind with the logging user, then uses the admin dn to get the logging user’s group and I believe it then tries to match groups to see if they are whitelisted