checkitem problem

[Norbert Wegener]

I get an attribute/value from ad via freeradius and want this as a 
checkitem in another module.

Therefore I added
checkItem User-Password primaryGroupID :=

to ldap.attrmap

and have the following users:

DEFAULT User-Password == "wrong”
Service-Type = Framed-User,
Tunnel-Type:1 = VLAN,
Tunnel-Medium-Type:1 = IEEE-802,
Tunnel-Private-Group-ID = VL-SBS-AD02-0001,

DEFAULT User-Password == "515”
Service-Type = Framed-User,
Tunnel-Type:1 = VLAN,
Tunnel-Medium-Type:1 = IEEE-802,
Tunnel-Private-Group-ID = VL-SBS-AD02-0002,

radiusd -AX says:
...
rlm_ldap: looking for check items in directory...^M
rlm_ldap: Adding primaryGroupID as User-Password == "515"^M

The 515 is form AD and for me its seems to be what I expect.

rlm_ldap: looking for reply items in directory...^M
rlm_ldap: user host/28tef004.ww006.mycompany.net authorized to use 
remote access^M
rlm_ldap: ldap_release_conn: Release Id: 0^M
modcall[authorize]: module "ldap" returns ok for request 11^M
users: Matched entry DEFAULT at line 2^M

Now I would assume, User-Password == "515" is added to the list of 
checkitems.
Nevertheless the first DEFAULT Entry of the users file is taken.
What am I missing?
The complete typescript is at

http://www.wegener-net.de/freeradius/typescript

Thanks
Norbert Wegener