Hi Thanks for that, I just configured by using sssd. its working fine but still , it does not restrict user ..i was following this http://www.couyon.net/1/post/2012/04/enabling-ldap-usergroup-support-and-... and my configuration is [sssd] config_file_version = 2 services = nss, pam domains = LDAP [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd [pam] # Example LDAP domain [domain/LDAP] id_provider = ldap auth_provider = ldap ldap_schema = rfc2307bis ldap_uri = ldap://auth4.uk.xxxx.lan ldap_search_base = l=uk,dc=xxxx,dc=lan ldap_group_member = uniquemember ldap_access_filter = cn=system-users,ou=Groups,l=uk,dc=xxxxx,dc=lan chpass_provider = ldap tls_reqcert = demand ldap_tls_cacert = /etc/openldap/cacerts/CA-lego.crt and i used the according : http://docs.fedoraproject.org/en-US/Fedora/15/html/Deployment_Guide/chap-... #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session required pam_mkhomedir.so umask=0022 skel=/etc/skel/ session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session sufficient pam_sss.so session required pam_unix.so but no luck .. Thanks for further help On Tue, Mar 26, 2013 at 10:02 AM, Arpit Tolani <arpittolani(a)gmail.com&gt;wrote: -- Regards Fosiul Alam 07877100621 http://www.fosiul.co.uk