Ldap-Group and EAP

[Benoît Bianchi]

I have trouble to set up some authorization upon ldap attribute of the user:
I have different SSID for my wireless LAN, using WPA or WPA2 with EAP/TTLS
and ldap auth which work fine right now with Freeradius
How can I prevent user without some ldap special attribute to get
authenticated on a special SSID (which is send with the access request as:
Called-Station-Id = "00-12-34-56-78-90:SSID" ) ???