FreeRadius LDAP group verification not working for me

[Condor]

Hi all, i'm really brand new on freeradius. i'm using freeradius 3.0.4 with ldap, ldap autethication work for me fine with "o=organitation" but not with group = cn, maybe the ldap configuration is not the standart
I'm following these thread: lists.freeradius.org/pipermail/freeradius-users/2016-December/085971.html
For me:
in /mods-available/ldap
ldap { server = "x.x.x.x"
 base_dn = "o=organization,cn=telecom"}

user { base_dn = "o=organization,cn=telecom" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"}
group {  base_dn = "o=organization,cn=telecom"                filter = '(cn=telecom)'
        name_attribute = cn
                membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))"
                membership_attribute = 'memberUid'
        }
on radius -X :
Received Access-Request Id 125 from y.y.y.y:42420 to x.x.x.x:1812 length 78 User-Name = 'usertest' User-Password = '*****' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x075a82e674d1e57b22856618bd3adc87(2) Received Access-Request packet from host y.y.y.y port 42420, id=125, length=78(2)  User-Name = 'usertest'(2)  User-Password = '*****'(2)  NAS-IP-Address = 127.0.1.1(2)  NAS-Port = 0(2)  Message-Authenticator = 0x075a82e674d1e57b22856618bd3adc87(2) # Executing section authorize from file /etc/raddb/sites-enabled/default(2)   authorize {(2)  eap : No EAP-Message, not doing EAP(2)   [eap] = nooprlm_ldap (ldap): Reserved connection (4)(2)  ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})(2)  ldap :    --> (uid=usertest)(2)  ldap : EXPAND o=organitation,cn=telecom(2)  ldap :    --> o=organitation,cn=telecom(2)  ldap : Performing search in 'o=organitation,cn=telecom' with filter '(uid=usertest)', scope 'sub'(2)  ldap : Waiting for search result...(2)  ERROR: ldap : Failed performing search: The specified DN wasn't found, check base_dn and identityrlm_ldap (ldap): Released connection (4)(2)   [ldap] = fail(2)  } #  authorize = fail(2) Invalid user (ldap: Failed performing search: The specified DN wasn't found, check base_dn and identity): [usertest/******] (from client Renaju port 0)(2) Using Post-Auth-Type Reject(2) # Executing group from file /etc/raddb/sites-enabled/default(2)  Post-Auth-Type REJECT {(2)  attr_filter.access_reject : EXPAND %{User-Name}(2)  attr_filter.access_reject :    --> usertest(2)  attr_filter.access_reject : Matched entry DEFAULT at line 11(2)   [attr_filter.access_reject] = updated(2)  } # Post-Auth-Type REJECT = updated(2) Delaying response for 1 seconds
-------
# in the "default" server
authorize {
...
       eap {                 ok = return                 updated = return         }
         ldap
         group_authorization

# In the "inner-tunnel" server:
authorize {
...
         eap {                 ok = return         }
         ldap
         group_authorization
I create "policy.d/group_authorization" the file not exist
# in policy.d/group_authorization:
group_authorization {   if (&Huntgroup-Name == "telecom") {     if (&LDAP-Group[*] == "o=organization,cn=telecom") {       ok     }     else {       update reply {         &Reply-Message := "Not authorized for telecom"       }       reject     }   }   elsif (&Huntgroup-Name == "telecom") {     reject   }}
Thanks!