You don’t need the &control:, just use: > if (Ldap-Group == "Gast”) Btw, that mailing list is focused to the development. Please, use the the _users_ mailing list http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users> — Jorge Pereira