differentiate ldap

hi I have 2 ldap servers containing computers accounts with the same DN I don't know how differentiate access-accept or "ldap_1/2 returns ok" I want to put ldap_1's computers in vlan 1 and ldap_2 's computers in vlan 2 . What is the best practice to do this ? maybe with unlang ??? i've read the man authorize { ... group { ldap_1 ldap_2 } ... } authenticate{ Auth-Type ldap { group { ldap_1 { reject = 1 ok = return } ldap_2 { reject = 1 ok = return } } } Help please!