Authenticate to AD but only allow certain group

[Brian C. Huffman]

All,

I've got authentication working nicely with MSCHAP, but now I'd like to 
only allow users that are members of a certain AD group.

I would prefer to have this happen only when requests come from a 
specific client (wireless access point).  In this case the idea is to 
have users only be able to get wireless access when they're in a 
specific AD group.

How can I do this in freeradius?

Thanks,
Brian