Set reject in post-auth

[paul smith]

Hi,

I've been trying to set reject in the post-auth section if a certain
attribute hasn't been set, but it doesn't seem to work (obviously I've
messed it up)

post-auth {

if (!Session-Timeout) {
    update control {
              Auth-Type := Reject
    }
}

}

Am I updating the wrong thing, or is it not possible to perform a
reject in the post-auth?

thanks,

paul