>when do you think it should occur (as part of authentication of client to >AS or as part of receving cert). My opinion: as part of receiving the cert. EAP authentication methods such as SecurID are already specified and thus cannot be changed so as to push policies. So this needs to be done outside of the EAP authentication process.