LDAP queries in general should not be "contains" or "starts with" or "like". I'm getting whacked by my administrator because the crowd queries are needlessly complex and are all "contains" - i.e. ray_harrison. The system should really default to equals (i.e. exact match) and provide the ability to customize how they are done. Also, there is no need at all to force an object class search. As an example - in Active Directory, all you should have to do is search for sAMAccountName=

{input user}

with nothing else needed. Unfortunately, I will have to default to the internal LDAP mechanisms in your other products until this can be worked through - great concept though!