Dear listmembers, I have following setup: - Centos 6.4 - freeradius version: radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51 - authorization & authentication in ldap (openldap) What I am trying to achieve is: - manage radius profiles completely in ldap with replyItems - return reply Items of multiple profiles to a user if he belongs to multiple profiles Example RADIUS Profiles: dn: uid=aosReadWrite,ou=profiles,ou=radius,dc=example,dc=com cn: AOS Read-Write objectClass: radiusObjectProfile objectClass: radiusProfile uid: aosReadWrite radiusReplyItem: Alcatel-Access-Priv += "Alcatel-Read-Priv" radiusReplyItem: Alcatel-Access-Priv += "Alcatel-Write-Priv" radiusReplyItem: Alcatel-Access-Priv += "Alcatel-Admin-Priv" radiusReplyItem: Alcatel-Acce-Priv-F-W1 = 0xffffffff radiusReplyItem: Alcatel-Acce-Priv-F-W2 = 0xffffffff dn: uid=sosReadWrite,ou=profiles,ou=radius, dc=example,dc=com cn: screenOS Read-Write objectClass: radiusObjectProfile objectClass: radiusProfile uid: sosReadWrite radiusReplyItem: NS-Admin-Privilege = "Root-Admin" Example RADIUS User: dn: uid=hachmer,ou=users,ou=radius,dc=example,dc=com cn: Tobias Hachmer givenName: Tobias mail: tobias.hachmer@stadt-frankfurt.de radiusServiceType: Administrative-User sn: Hachmer uid: hachmer objectClass: top objectClass: inetOrgPerson objectClass: radiusProfile userPassword:: ... radiusGroupName: aosReadWrite radiusGroupName: sosReadWrite I don't know how to configure FreeRADIUS to read the "radiusGroupName" attribute and attach the configured return Items to the return list. Using unlang I am able to do this: if(Ldap-Group == "cn=aosReadWrite,ou=groups,ou=radius,dc=example,dc=com") { update reply { Alcatel-Access-Priv = Alcatel-Read-Priv Alcatel-Access-Priv += Alcatel-Write-Priv Alcatel-Access-Priv += Alcatel-Admin-Priv Alcatel-Acce-Priv-F-W1 := 0xffffffff Alcatel-Acce-Priv-F-W2 := 0xffffffff Alcatel-Asa-Access := All } } if(Ldap-Group == "cn=sosReadWrite,ou=groups,ou=radius, dc=example,dc=com ") { update reply { NS-Admin-Privilege := Root-Admin } } This is working fine but has the disadvantage that I have to configure the return items static into freeradius configuration files. I want to manage these profiles also in ldap. Is this possible? Kind regards, Tobias Hachmer