I need to conditionally add a reply pair based upon Huntgroup-Name and a custom attribute.  Pseudocode follows for what I’m trying to accomplish:

If Huntgroup-Name == NetSensory then

   if LDAP-Group-Requirement == “NP-Admin” then

            pairadd(reply, NetSensory-Permission, “npadmin”)

   Elsif LDAP-Group-Requirement == “NP-Read” then

            pairadd(reply, NetSensory-Permission, “npread”)

   Elsif LDAP-Group-Requirement == “NP-Insight”

            pairadd(reply, NetSensory-Permission, “insight”)

   Endif

Endif

I thought about using an external program (e.g., Perl module) in post-auth to accomplish this.  Is this reasonable or is there a better way?