David Aldwinckle wrote: > Is it possible to do LDAP group checking in post-auth of the default server even if the request is EAP? Yes. if (LDAP-Group == "banned") { reject }