Hi Alan, Thanks for your reply. My goal here is to switch the user's group dynamically, depending on his location on the network. Unfortunately, what I'm seeing on exit from the conditional is that it returns a noop. Should there be an 'ok' after the sql update command? I'm using the following conditional statement in the main authorize section. if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' and \ vlan_id='%{NAS-Port}'}" } if (&Tmp-String-0 != "") { update request { Tmp-String-1 := "%{sql: update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } else { reject } } Please suggest! Thanks, Amardeep