I'm trying to work out (in 2.0.0) how to achieve "matching group specific per user reply attributes" using rlm_sql, based on which group(s) matched the authentication request. So, for instance, a user might belong to both DIALUP and WIRELESS groups. But I only want the per-user reply attributes relevant to the access request being processed, for instance Mikrotik-Rate-Limit only gets set if the request matched WIRELESS (via a huntgroup match). As far as I can tell, this would require some surgery to rlm_sql, and an additional (optional) CheckGroup column in the 'radreply' table: UserName,Attribute,op,Value,CheckGroup radiustest,Mikrotik-Rate-Limit,=,512k/512k,WIRELESS radiustest,Some-Dialup-Attribute,=,foo,DIALUP radiustest,Some-Common-Attribute,=,bar, So the authorize_reply_query could then be something like: authorize_reply_query = "\ SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ AND (CheckGroup = '' OR CheckGroup IN(%{control:Matched-Groups})) ORDER BY id" Then if the request came from a NAS which has a matching check attribute for the WIRELESS group, only 'radreply' items with CheckGroup of WIRELESS (and those with no CheckGroup) would be returned. So in this case, Mikrotik-Rate-Limit and Some-Common-Attribute. Obviously the surgery to rlm_sql would be in building %{control:Matched-Groups}, which would mean shuffling some code around, as currently the groups aren't looked at till after the per-user reply attributes are processed. Or is there some other way of doing this I'm spacing on? -- hugh