simple mac-auth

Hi! im currently running eap-tls with username and password (from ldap), but now we're having a bunch of "stupid" wlan-client machines, and we need an simple mac-auth (from ldap?) to the network. basic idea: (example from outside world) "so, no certificate and login credentials, cant let you in. but im on an vip-list!. Oh, i see, come on in, sorry for inconvenience", for now we are happy to get just that to work, next level would be something concerning vlans... i think (in the long run) we don't want to have too much accessibility in those stupid machines. poorly explained, not enough coffee in veins yet... thanks in advance