LDAP Group assign to vlan after AD user authentication

[James]

Hi,

I've successfully set up a radius server to support 802.1x
authentication using peap mschapv2 and samba to authenticate users
against AD.
To do this I followed configuration on the freeradius.org website and
the AD integration howto on deployingradius.com, thank you very much
for writing these!

I now need to assign the vlan due to membership of some group in AD
and I understand that an ldap lookup is needed.

Where in the configuration do I check this group and map it to a vlan?
Can I do it as a default entry in the users file or is it needed
somewhere else?

Thank you very much,

James