PAM-MySQL authenticating group

I've had a good look round all over the place, but can't find any clear

answers about this...

I've got a remote VPN login system in development using RADIUS and
PAM-MySQL to validate a user/password combo, but I also want to
incorporate a concept of the user being within one or more groups.


If the user enters a correct user-name and password, but the group
requested doesn't match their allowed groups, then reject their login
attempt.


I've assumed there would be some sort of PAM conversation requirement
to capture the requested group but can't see how to enable this.


Otherwise, would a further PAM module be required to authenticate this
group selection?


Any help would be greatly appreciated....!