Use a multi-valued attribute (allowedservices) and put in some magick words like (ftp, samba, mail, ...)
that is exactly what i was looking for. thanks.i may be an ace at setting up ldap & kerberos now, but i still dont know how to use ldap. ;)
Myren