Also, it's possible that a service that does not use the authorisation data will use some other out-of-band means to determine a principal's authorisation information, which could involve accessing a network directory service. -- Luke -- Luke Howard | PADL Software Pty Ltd | www.padl.com