Radius on server X; VPN on server Y; Samba on server Z

Hi, I have the following: * Radius on server X * VPN on server Y * Samba on server Z Each server is located on a different continent. :-) Ok, user "foo" now connects to the VPN server and gets authorized by radius. Fine. Now, i want him to allow to connect to the samba server. Ideally without entering any user+password combination (is that safe enough?); i thought about, restricting samba connections only from ip-addresses of the VPN server. But he only is allowed to access his private space under samba. He is not alloed to access the space of another user "bar". Any hints on that issue? Thank you. Sascha