From f2b1aa4962291ef09a45be14cd84d01755dae9ea Mon Sep 17 00:00:00 2001
From: Andreas Steffen <andreas.steffen@strongswan.org>
Date: Mon, 11 Oct 2010 12:20:45 +0200
Subject: [PATCH] added eap-radius-filter_id option to strongswan.conf

---
 man/strongswan.conf.5.in | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/man/strongswan.conf.5.in b/man/strongswan.conf.5.in
index f46f22e29..e5222614a 100644
--- a/man/strongswan.conf.5.in
+++ b/man/strongswan.conf.5.in
@@ -223,6 +223,19 @@ option in
 .BR charon.plugins.eap-radius.eap_start " [no]"
 Send EAP-Start instead of EAP-Identity to start RADIUS conversation
 .TP
+.BR charon.plugins.eap-radius.filter_id " [no]"
+If the RADIUS
+.I tunnel_type
+attribute with value
+.B ESP
+is received, use the
+.I filter_id 
+attribute sent in the RADIUS-Accept message as group membership information that
+is compared to the groups specified in the
+.B rightgroups
+option in
+.B ipsec.conf (5).
+.TP
 .BR charon.plugins.eap-radius.id_prefix
 Prefix to EAP-Identity, some AAA servers use a IMSI prefix to select the
 EAP method