Strategy for grouping users for authentication

[Alex French]

Hi,

We are using Freeradius 1.1.7 to authenticate a large group of users
for one service, with a pgsql backend. I would now like to start using
our radius servers to also authenticate other groups of users for
specific services, e.g. admin users who can access an apache frontend
etc using PAM.

My question is, what's the best way to classify and group the users to
ensure that group X can access one service but group Y can access
another, etc?

My first thought is to use an attribute like the NAS-Id to identify
the service and require certain user groups for each Nas id in the
clients file. However, this does not allow any more granularity than
the machine making the request -- for example, login, POP and httpd
may all be on the same server but have different groups that should be
able to access them.

Can anyone point me in the right direction?

Thanks,

Alex