Chapter 9 – RADIUS Services for Linux

1. Using an unlang rule that references both the authentication request and backend group membership is the classic solution to this. The rule should specify the following:

1. If you are making a VPN request, then you need to be in the VPN users group to authenticate.
2. If you are making an administrative access request, then you need to be in a network admins group.
3. This approach can be extended to include any number of authentication types, device types, RADIUS attribute values, and group memberships.

   An example unlang rule that delivers the requested functions might look like this:

   if(&NAS-IP-Address == "192.168.122.20") {
       if(Service-Type == Administrative && LDAP-Group == "Network Admins") {
               update reply {
                  ...