Those LDAP users who have access but are not listed as users (if there are any) If your LDAP server does not support the member-of-overlay in LDAP filters, the The %uid placeholder is replaced with the login name entered by the user upon login. . You may change this to enforcing the home folder rule with the occ .