rlm_passwd and Class -attribute

Hello. We're running freeradius 1.0.5 on SLES9, and are trying to set up FR to work against a cisco vpn concentrator. We're using rlm_passwd as backends, both crypt and mschapv2-hashes.(NT-Password) As we've got different groups in vpn, we need to set the Class -attribute in replies sent back to the NAS. This Class -attribute is based on with password file (rlm_passwd) that had the user in question. Previously I've just hacked this together with Exec-Program-Wait in the users -file and a shell script, but I'm now looking for a cleaner solution. Any help appriciated. -- Lasse