Allocating VLAN by MAC address on HP 2600 series switches using Freeradius and an SQL backend

A basic knowledge of CLI switch management, VLANs, Radius and SQL is assumed Switch configuration snippet Adapted from Web and MAC Authentication for the Series 2600/2600-PWR and 2800 Switches
vlan 101 name "unidentified" tagged <uplink port(s)> exit vlan 102 name "bio" tagged <uplink port(s)> exit radius-server <ip> key <SEKRIT> aaa port-access mac-based addr-format multi-colon aaa port-access mac-based <ports> unauth-vid 101 aaa authentication port-access chap-radius aaa port-access mac-based <ports>

Configuration snippet /etc/freeradius/clients.conf

client 172.29.x.y { shortname = switch-eeb secret = <sekrit> nastype = other }

The RADIUS Attributes used by the HP 2600 series to assign vlan

Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1"

Freeradius's expected attributes usercheck: id, Username, Attribute, op, Value SQL that provides this info from the departmental computing database (postgresql.conf: authorize_check_query)
SELECT 1 as id,mac as Username, 'User-Password' as Attribute,'==' as op, mac as Value from mac_hardware_table \ where mac='%{SQL-User-Name}';

userreply: id, Username, Attribute, op, Value This is left blank, using group based info instead, so the SQL is (postgresql.conf: authorize_reply_query)

SELECT 1 AS id, mac AS Username, 'User-Password' AS Attribute, mac AS Value, '==' AS op FROM mac_hardware_table \ WHERE false;

groupcheck: id, Groupname, Attribute, op, Value Left blank, group membership defined in mac_hardware_table. Here's some sql that returns nothing. (postgresql.conf: authorize_group_check_query)
SELECT 1 AS id, 'A' AS Groupname, 'A' AS Attribute, 'A' AS Value, '==' AS op WHERE false

groupreply: id, Groupname, Attribute, op, Value Added a table to the database using the schema expected by the default query, so only minor changes are required to link it to the mac_hardware_table (postgresql.conf: authorize_group_reply_query
SELECT ${groupreply_table}.id, ${groupreply_table}.Groupname, $ {groupreply_table}.Attribute, \ ${groupreply_table}.Value, ${groupreply_table}.Op \ FROM ${groupreply_table},mac_hardware_table \ WHERE mac_hardware_table.mac = '%{SQL-User-Name}' \ AND mac_hardware_table.vlan = ${groupreply_table}.Groupname \ ORDER BY ${groupreply_table}.id"

Example data
# SELECT * FROM groupreply; id | groupname | attribute | op | value ----+-----------+---------------------------+----+---------12 | bio | Tunnel-Medium-Type:0 | = | IEEE-802 15 | bio | Tunnel-Private-Group-Id:0 | = | 102 9 | bio | Tunnel-Type:0 | = | VLAN # SELECT mac,owner,vlan FROM mac_hardware_table; mac | owner | vlan -------------------+-----------------------+-----00:0b:cd:xx:xx:xx | A Test Owner ato999 | bio