Hi,

I've just run into a serious problem with the above:

domainname= 16 characters
domainuser= firstname.lastname (common format) = 16 characters

so,

grant arole to "domainname\domainuser" fails (too long)

In this case, the domainname is slightly longer than usual but this means that all domain user names would have to be limited to 15 characters. If they use the dot notation to separate first.last name then it becomes only 14 characters.

Whether this would be workable or not I don't know but it would be good if one or more domains (especially a default domain) could be 'registered' with the system and then roles could be granted using the following syntax:

grant arole to "\domainuser"

The backslash indicates it is a 'trusted' user that would use the default domain as registered on the system.
Tom