Authentication filtering across many-to-many relationship

Ah yes, correct. I overlooked it. What matters is the name of the mapped class member. You should use it this way:

  AArgs.Criteria
      .CreateAlias( 'KlasseUsers', 'ku' )
      .CreateAlias( 'ku.UserAccount', 'u' )
        .Where( TLinq.Eq( 'u.ID', iiID ) )