>  >    >> I still cannot figure out how to pass this value from authorize to
>  >    >> post-auth.
>  >    >
>  >    >  It works for PAP.  The only reason it doesn't work is you're running
>  >    > EAP, and that's more complicated.
>  >
>  >    Is there something extra that needs to be done in order for the value to
>  >    be preserved when running EAP?
>  >
>  >    >  There's no need for a 100KB debug output.  Try a *simple* test.
>  >
>  >    What tool(s) can I use to run a simple EAP test that would still use AD
>  >    for authentication and LDAP for authorization?
> 
>  eapol_test  ?

Thanks, I'll give it a try and post the debug.  Am I wrong to be surprised that there is no answer for the first question, though?  There has to be a great many users out there using EAP and assigning dynamic VLAN based on LDAP attributes.... or, not?

A.