Take a look at http://lists.freeradius.org/pipermail/freeradius-users/2016-January/081595.html and see if that helps. If you want to allow the attributes to change between the original authentication and a reauth you'll have to modify that quite a bit and do some SQL in the outer tunnel server based on inner tunnel attributes.