Tricky problem with ldap and primary groups in AD

[Franks Andy (RLZ) IT Systems Engineer]

>   That works fine. However I'm still intrigued about why the other 
> method fails, and I also presume this method doesn't allow multiple 
> attribute types to be updated as per the exec-program-wait script in 
> the example documentation?

	>  Yes

> Maybe it's not supported? Must admit I am a little confused about the 
> output_pairs = config. Are configuration items totally unrelated to 
> control attributes? That's probably a daft question but I am stumped!

	>  config == control.  The names changed in v2.


Thanks Alan, that helps clear my understanding on that point.
It's working from the rlm_exec module as intended now, not sure what I
did wrong yesterday.
I tried output_pairs=control in the module but it didn't like it, -
should that work if =config is v1 stuff?

Thanks again
Andy