FreeRadius - multiple SSID's
I'm running Project LEDE (OpenWRT) on 2x TP-Link Archer C7's.
I have setup 3 SSID's (WPA2-PSK): wifi, wifi-guest and wifi-admin.
When you connect to SSID wifi you'll be connected to vlan10, wifi-guest is vlan11 and wifi-admin is vlan12.
All is working great so far.
But now I want to implement WPA2 enterprise (WPA2-EAP) for the SSID wifi and wifi-admin.
But if I setup a Radius server and create user John, would John be able to connect to both SSID's with his credentials?
Is there a way to restrict John from connecting to wifi-admin and let him only connect to wifi?
John is not an "admin" so he is not allowed to access wifi-admin on vlan12.
On the other hand I have user Matthew, this user needs to be able to connect to both SSID's.
On normal days he connects to wifi but sometimes he needs to connect to wifi-admin to do admin tasks in vlan12.
Is it not possible?