For anyone who may lookup for that kind of information, I dig a bit more and base ont he following thread ( http://lists.freeradius.org/pipermail/freeradius-users/2016-August/084450.ht...) I manage to make it working. So here's what I did... Create another server instance file for ldap ldap ldap_get_department { server = "myserver.example.com" port = 389 identity = "radius@myserver.example.com" password = "password" base_dn = "DC=domain,DC=example,DC=com" update { reply:department := 'department' } user { base_dn = "${..base_dn}" filter = "(&(objectCategory=person)(objectClass=user)(sAMAccountName=%{%{%{Stripped-User-Name}:-%{mschap:User-Name}}:-%{User-Name}}))" } options { chase_referrals = yes rebind = yes } } In the inner tunnel post-auth section, I did enable that part.. if (1) { update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } Also added the ldap_get_department module wihtin the authorize portion of inner-tunnel And in the post-auth of the default server added the check for attribute if ("%{toupper:%{session-state:department}}" == "IT/DEV") { if ("%{toupper:%{Ldap-Group}}" == "VLAN_MTL_ADMIN") { update reply { Tunnel-Private-Group-Id := 149 } } else { update reply { Tunnel-Private-Group-Id := 143 } } } -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster Le jeu. 21 févr. 2019, à 10 h 41, Luc Paulin <paulinster@gmail.com> a écrit :

Hi List,

I was wondering if it would be possible to use the Active Directory user's attributes. As we're standardizing our AD, all user should have the Department attribute field fill. So instead of using AD groups to dynamically assign vlan, I was thinking to use that field instead. Would that be something possible?

Thanx!

-- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster