Authorise based on Calling Station ID ?

Hi All I have a two box wifi solution where the controller performs dot1x/EAP authentication of the end user then a policy management box that sits behind that implements appropriate QoS and traffic policies to the users traffic Of course the Authen part is easy as it's just the normal username/password in users The Author is a little bit trickier and I was interested in some opinions on how to resolve... Basically the policy manager uses the mac address to authorise the device The mac address was sent by the wifi controller as the calling-station-id but the question is how do I match that field against the user to authorise them? Darren