Conditional attributes with AD

I've successfully gotten AD auth working, and now I'd like to be able to assign VLAN's based on group membership, but I'm having a hard time figuring out where and how to do that. Where do I put the "if" statements to check group membership? Does AD auth even work like this, or do I need to be using LDAP auth? Thank you, -Scott