Unix Group based White-List

We would like to configure authentication using the Unix module. We would also like to have a white-list based on a group in /etc/group. We created an entry in the /etc/raddb/users file that looks like, DEFAULT Group == "enabled", Auth-Type := System Unfortunately, this passes all users with a valid account through, even when they are not listed in the group. We can set up a blacklist with DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled." DEFAULT Auth-type := System but would prefer a white-list approach. Does anyone know how to do this? Sid