This optional parameter, in conjunction with CheckGroupServer,
allows you to set a Class reply attribute that depends on which NT group
the user is a member of. Recall that if you set the Class in an access
reply, then subsequent accounting requests sent by the NAS for that
session will contain exactly the same Class attribute. This is useful for
remembering which accounting group or rate to charge the
user.
CheckGroup is a comma-separated pair of names. The first is an
NT group name, the second is an arbitrary string. During authentication,
if the user is a member of the NT group, then the Class attribute in the
reply will be set to the arbitrary string. The first match found will be
used.
For example:
<AuthBy ADSI>
CheckGroupServer romeo
CheckGroup USVPN,premium
CheckGroup UKVPN,standard
....
</AuthBy>
In this example, if a user is a member of the NT
group USVPN, then the reply will contain Class=premium. If they are in
UKVPN group, then the reply will contain Class=standard. If they are in
neither group, then no Class will be set in the reply.