I need to have my NetworkGroup get passed one set of attributes and my ServerGroup get passed another. But I have some EnterpriseAdmins who need access to both sets so i need to pass the correct attribute back depending on which device they try to auth from. User Joe is a EnterpriseAdmin. He is a member of the NetworkGroup and the ServerGroup so I need him to have the correct attributes passed to him depending on which NAS-IP-Address he comes from respectivly. For instance, if joe trys to log in through 192.168.0.50 I need to pass back "Class = OU=ServerGroup". If joe trys to log in through 192.168.0.1 I need to pass him "Class = OU=NetworkGroup". The way it stands no matter which NAS-IP-Address he comes from because he is a member of both groups he gets both attributes sent back from radgroupreply. User Sally is a member of the NetworkGroup so I only want radgroupreply to send just the attributes for the NetworkGroup. User Bob is a ServerGroup so I only want bob to get the attributes from the ServerGroup. mysql> select * from radcheck; +----+----------+----------------------+----+---------------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+----------------------+----+---------------------------------------+ | 8 | joe | Password-With-Header | := | {md5}928a40033e748ad825e92ec4f9870696 | | 9 | sally | Password-With-Header | := | {md5}928a40033e748ad825e92ec4f9870696 | | 10 | bob | Password-With-Header | := | {md5}928a40033e748ad825e92ec4f9870696 | +----+----------+----------------------+----+---------------------------------------+ mysql> select * from usergroup; +----------+--------------+----------+ | UserName | GroupName | priority | +----------+--------------+----------+ | joe | NetworkGroup | 1 | | joe | ServerGroup | 2 | | sally | NetworkGroup | 1 | | bob | ServerGroup | 1 | +----------+--------------+----------+ mysql> select * from radgroupcheck; +----+--------------+----------------+----+--------------+ | id | GroupName | Attribute | op | Value | +----+--------------+----------------+----+--------------+ | 9 | ServerGroup | NAS-IP-Address | = | 192.168.0.50 | | 10 | ServerGroup | Auth-Type | = | MD5 | | 11 | NetworkGroup | NAS-IP-Address | = | 192.168.0.1 | | 12 | NetworkGroup | Auth-Type | = | MD5 | +----+--------------+----------------+----+--------------+ mysql> select * from radgroupreply; +----+--------------+-----------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+--------------+-----------+----+-----------------+ | 17 | NetworkGroup | Class | := | OU=NetworkGroup | | 18 | ServerGroup | Class | := | OU=serverGroup | +----+--------------+-----------+----+-----------------+ Steps to reproduce if needed. insert into usergroup (UserName, GroupName, priority) VALUES ('joe', 'NetworkGroup', 1); insert into usergroup (UserName, GroupName, priority) VALUES ('joe', 'ServerGroup', 2); insert into usergroup (UserName, GroupName, priority) VALUES ('sally', 'NetworkGroup', 1); insert into usergroup (UserName, GroupName, priority) VALUES ('bob', 'ServerGroup', 1); insert into radgroupcheck (GroupName, Attribute, op, value) VALUES ('ServerGroup', 'NAS-IP-Address', '=', '192.168.0.50'); insert into radgroupcheck (GroupName, Attribute, op, value) VALUES ('ServerGroup', 'Auth-Type', '=', 'MD5'); insert into radgroupcheck (GroupName, Attribute, op, value) VALUES ('NetworkGroup', 'NAS-IP-Address', '=', '192.168.0.1'); insert into radgroupcheck (GroupName, Attribute, op, value) VALUES ('NetworkGroup', 'Auth-Type', '=', 'MD5'); insert into radgroupreply (GroupName, Attribute, op, Value) VALUES ('NetworkGroup', 'Class', ':=', 'OU=NetworkGroup'); insert into radgroupreply (GroupName, Attribute, op, Value) VALUES ('ServerGroup', 'Class', ':=', 'OU=serverGroup'); Thanks for your time.