Dynamic VLANing and anonymous identity on re-auth?

[Palmer J.D.F.]

> if you are doing the authorise in the main virtual server after the
> inner-tunnel has done its business, then you must copy the User-Name
> to an internal attribute that can be used in the post-auth section
> (for example)

Does the inner-tunnel get called on a re-auth? As said the only time I
see the real username on a re-auth is when it appears to be produced
from the cache.
> [peap] Adding cached attributes to the reply:
>         User-Name = "test-user"

At what point can I copy it?
 
I have sql.authorize sections in post-auth on both the inner and default
sections, I've tried putting them all over the place. :-D

Cheers,
Jezz.