Update: I'm an idiot, apparently. I'd made a custom instance of the SQL RLM to fit the exact needs and avoid overwriting existing config files, but overlooked this little bit in the config: # This entry should be used for additional instances (sql foo {}) # of the SQL module. #group_attribute = "${.:instance}-SQL-Group" # This entry should be used for the default instance (sql {}) # of the SQL module. group_attribute = "SQL-Group" Running with radiusd -XX showed that it didn't substitute the group attribute correctly into the groupcheck/groupreply queries, which put me on the trail and led me to find my error. Uncommenting the first group_attribute line and commenting out the second fixed it. Everything works now. -- Rens Houben Systemec Internet Services