radius_cisco_privilege_login

#/etc/raddb/sites-enabled/default
[...]
#  Post-Authentication
#  Once we KNOW that the user has been authenticated, there are
#  additional steps we can take.
post-auth {
[...]
  #
  #  Un-comment the following if you want to modify the user's object
  #  in LDAP after a successful login.
  #
  ldap
  if(LDAP-Group == "net" && LDAP-Group == "cisco"){
        update reply {
          cisco-avpair = "shell:priv-lvl=15",
        }
    }
    else {
        if(LDAP-Group == "net"){
          update control {
                  Auth-Type := Accept
          }
        }
        else {
          reject
        }
    }

[...]
}
[...]