Conditionally adding reply pair

I need to conditionally add a reply pair based upon Huntgroup-Name and a custom attribute. Pseudocode follows for what I'm trying to accomplish: If Huntgroup-Name == NetSensory then if LDAP-Group-Requirement == "NP-Admin" then pairadd(reply, NetSensory-Permission, "npadmin") Elsif LDAP-Group-Requirement == "NP-Read" then pairadd(reply, NetSensory-Permission, "npread") Elsif LDAP-Group-Requirement == "NP-Insight" pairadd(reply, NetSensory-Permission, "insight") Endif Endif I thought about using an external program (e.g., Perl module) in post-auth to accomplish this. Is this reasonable or is there a better way?