On 21 May 2012, at 22:24, Kenneth S Mclane wrote: > So I should leave it as "self_check"? No. You set it as plain / don't set it at all, as the password needs to be passed through Catalyst un-mangled - as the auth is done by logging in _as the user_ (and therefore with their password) in LDAP. Cheers t0m