user_group is really just a filter and do nothing else, so I don't have any idea how it can have influence on the skin.
I also didn't expect it to have the effect it did.
Is the user's profile is correctly created and contains rights informations ?
I believe so. I can go to the user's page in XWiki and it shows up as I expect it.
Is this append all the time for any user ?
Sadly, I can only test for myself at the moment as I don't have access to the other users' passwords. - - - - - - - - - - Now here's some more details: After I commented out the "xwiki.authentication.ldap.user_group", I still couldn't log in (well, half way, as I said before). Then I looked deeper in teh config and noticed that my search base DN was not what I expected. I changed it to include "cn=Users": xwiki.authentication.ldap.base_DN=cn=Users,dc=XXXX,dc=YYYY However, even then I couldn't log in. I'm not confident that is the right base_DN to use, but I'm unsure of what else to test. I also discovered that I had it falling back to XWiki's DB, so the problematic could still log in if I created her account manually: xwiki.authentication.ldap.trylocal=1 However, I'm not sure I like that solution. Regards, Brian. ----------------------------------------- CONFIDENTIALITY STATEMENT: This e-mail transmission contains information that is intended to be confidential. It is intended only for the addressee named above. If you receive this e-mail in error, please do not read, copy, or disseminate it. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.