/etc/freeradius/mods-enabled/ldap
update {
                control:Password-With-Header    += 'userPassword'
                control:NT-Password             := 'sambaNTPassword'
                control:LM-Password             := 'sambaLMPassword'
                control:                        += 'radiusControlAttribute'
                request:                        += 'radiusRequestAttribute'
                reply:                          += 'radiusReplyAttribute'
                reply:Class                     += 'deniedServices'
                reply:Operator-Name             += 'ou'
        }