Thanks, but sorry to say I am hard to learn.The admin guide says Enabling LDAP and Single Sign-on If your users use several applications, it can be beneficial to implement a Lightweight Directory Access Protocol (LDAP) interface to authorize user access across all the applications. Instead of storing user access information separately for each application, a central directory server controls access so that users can have one username and password for all applications. Clarity supports the LDAP v2 protocol (simple) protocol and uses a small subset of LDAP functionality including authentication (clear text or SSL), binding, and searching. Session-based cookies carry a token that is used to access session data and is persisted in the cache for single application environments or in a database for clustered environments. The user's web browser must accept cookies from the Clarity application, which are session-based, so they are never written to disk. When the user logs out, session information in the database and cache that correspond to the cookie are deleted.Clarity’s LDAP Synchronize New and Changed Users job synchronizes LDAP entries. It then stores the last date and time the job ran successfully and stores information in the MN_DIRECTORY_SERVERS database table. The next time the background job runs, it synchronizes only recently-created or changed user entries where the timestamp is greater than the value found in the CMN_DIRECTORY_SERVERS.LAST_SYNC_DATE property. Clarity does not check whether a user found in a Clarity group or in a search specified in the NSA is active or inactive in LDAP. Clarity checks only whether a user is present in a Clarity group or whether an attribute being searched for is present in Clarity. Clarity does not recognize nested Clarity groups. Before running LDAP synchronization jobs, ensure that users are associated with Clarity groups that the NSA search can find. Users in nested Clarity groups will not be checked when the LDAP synchronization jobs are run. If a user is deactivated on the LDAP server, the next time the synchronization job runs the user is deactivated in Clarity. If the user is re-activated on the LDAP server the user will not be re-activated in Clarity; you will need to re-activate the resource and Implementing Single Sign-on (SSO) Single sign-on (SSO) allows users access multiple systems using a single username and password. Once the server uses information that is stored in the LDAP directory to authenticate a user's identity, it allows access to the user's access privileges. Comparing the last sentense in the first paragraph and the SSO paragraph sounds to me a lot like: LDAP sync is not SSO but just storing ID's and password and not doing the authentication. Am I missing something or just hard to learn. Martti K.