On May 9, 2018, at 2:05 PM, Alan Buxey <alan.buxey at gmail.com> wrote: > if (&client:netdevice = yes && LDAP-Group != networkmgmt) { Should be if (("%{client:netdevice}" == "yes") && LDAP-Group != networkmgmt) { reject } That should work. Alan DeKok.