I want to have my MS IAS RADIUS check on the connection profile that a SSL VPN user selected: Users can only authenticate for profiles that match their group membership. But a single user can be allowed to connect to more than one connection profile, so forcing a user into a profile (with the CLASS attribute in the RADIUS Access-accept) does not work.
user jdoe, member of RemoteUsers, can login on RemoteUsersProfile
user bigceo, member of RemoteUsers and of RemoteExecutives, can login on RemoteUsersProfile and on RemoteExecutiveProfile
user bofh, member of RemoteUsers and of RemoteAdmins, can login on RemoteUsersProfile and on RemoteAdminProfile
So the RADIUS needs to know on which connection profile a user wants to log into. Does anybody know where in the RADIUS request the ASA puts the selected connection profile? And how does that show up on an IAS server?