Here's a strange problem: the Client-Shortname attribute won't match a regexp unless it's inside a string expansion. Simple example: # Fails if (Client-Shortname =~ /./) { update reply { Reply-Message += "XXX" } } # Succeeds if ("%{Client-Shortname}" =~ /./) { update reply { Reply-Message += "YYY" } } (Uncomment "shortname = localhost" from clients.conf). The first test fails to match, but the second one matches. Debug output: ... [files] users: Matched entry steve at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++? if (Client-Shortname =~ /./) (Attribute Client-Shortname was not found) ? Evaluating (Client-Shortname =~ /./) -> FALSE ++? if (Client-Shortname =~ /./) -> FALSE ++? if ("%{Client-Shortname}" =~ /./) expand: %{Client-Shortname} -> localhost ? Evaluating ("%{Client-Shortname}" =~ /./) -> TRUE ++? if ("%{Client-Shortname}" =~ /./) -> TRUE ++- entering if ("%{Client-Shortname}" =~ /./) {...} +++[reply] returns noop ++- if ("%{Client-Shortname}" =~ /./) returns noop ++[pap] returns updated Found Auth-Type = PAP ... This is built from the latest code on the v2.1.x branch. If I try with a different request attribute, like Client-IP-Address, it works fine. It's not a big issue, because I can just put the attribute in a string expansion to resolve it, but it was a bit confusing. Thanks, Brian.