I have a ldapserver which has a objectClass = eduPerson in eduPersonPrimaryAffiliation we have staff and student I did the ldapsearch from the radius server command line as: ldapsearch -h ldapserver "dc=EXAMPLE,dc=COM" -x -s sub uid=tom eduPersonPrimaryAffiliation # extended LDIF # # LDAPv3 # base <dc=EXAMPLE,dc=COM> with scope subtree # filter: uid=tom # requesting: eduPersonPrimaryAffiliation # # tom, People, example.com dn: uid=tom,ou=People,dc=example,dc=com eduPersonPrimaryAffiliation: staff # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [tom@radiusserver ~]# What I am trying to do is : if person (user)'s eduPersonPrimaryAffiliation=staff he/she can have 5 simultaneous connection else 1 simultaneous connection. I have configured ldap in /etc/raddb/modules/ldap so ldap bind is okay [ldap] performing user authorization for tom [ldap] expand: %{Stripped-User-Name} -> tom [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=tom) [ldap] expand: dc=EXAMPLE,dc=CIN -> dc=EXAMPLE,dc=COM [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldapserver:389, authentication 0 [ldap] bind as cn=tom,ou=People,dc=EXAMPLE,dc=COM/KEYBOARD to ldapserver:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=EXAMPLE,dc=COM, with filter (uid=tom) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok Where do I add the ldapchcek for eduPersonPrimaryAffiliation: staff/student or the right way of doing ? K