diff --git a/net/freeradius/Makefile b/net/freeradius/Makefile
index 4b8bd02ea..2bfb15184 100644
--- a/net/freeradius/Makefile
+++ b/net/freeradius/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		freeradius
-PLUGIN_VERSION=		1.5.0
+PLUGIN_VERSION=		1.5.1
 PLUGIN_COMMENT=		RADIUS Authentication, Authorization and Accounting Server
 PLUGIN_DEPENDS=		freeradius3
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
index bb91a2d01..38fa2a650 100644
--- a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
+++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
@@ -29,4 +29,16 @@
         <type>text</type>
         <help>Set the Base DN in format dc=example,dc=domain,dc=com</help>
     </field>
+    <field>
+        <id>ldap.user_filter</id>
+        <label>User Filter</label>
+        <type>text</type>
+        <help>Set the filter to search for users, for Active Directory change uid to samaccountname.</help>
+    </field>
+    <field>
+        <id>ldap.group_filter</id>
+        <label>Group Filter</label>
+        <type>text</type>
+        <help>Filter for group objects, should match all available group objects a user might be a member of.</help>
+    </field>
 </form>
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
index 36cc65f6a..3797eb5e5 100644
--- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
+++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
@@ -24,5 +24,13 @@
             <default>dc=example,dc=domain,dc=com</default>
             <Required>N</Required>
         </base_dn>
+        <user_filter type="TextField">
+            <default>(uid=%{%{Stripped-User-Name}:-%{User-Name}})</default>
+            <Required>N</Required>
+        </user_filter>
+        <group_filter type="TextField">
+            <default>(objectClass=posixGroup)</default>
+            <Required>N</Required>
+        </group_filter>
     </items>
 </model>
diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap
index 06d302f21..7b14fbbb5 100644
--- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap
+++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap
@@ -16,24 +16,70 @@ ldap {
 {%     if helpers.exists('OPNsense.freeradius.ldap.base_dn') and OPNsense.freeradius.ldap.base_dn != '' %}
         base_dn = '{{ OPNsense.freeradius.ldap.base_dn }}'
 {%     endif %}
-{%     raw %}
         sasl {
         }
         update {
+                control:Auth-Type               := 'radiusAuthType'
+                control:Simultaneous-Use        := 'radiusSimultaneousUse'
+                control:Called-Station-Id       := 'radiusCalledStationId'
+                control:Calling-Station-Id      := 'radiusCallingStationId'
+                control:LM-Password             := 'lmPassword'
+                control:NT-Password             := 'ntPassword'
+                control:LM-Password             := 'sambaLmPassword'
+                control:NT-Password             := 'sambaNtPassword'
+                control:LM-Password             := 'dBCSPwd'
                 control:Password-With-Header    += 'userPassword'
+                control:SMB-Account-CTRL-TEXT   := 'acctFlags'
+                control:Expiration              := 'radiusExpiration'
+                control:NAS-IP-Address          := 'radiusNASIpAddress'
+                reply:Service-Type              := 'radiusServiceType'
+                reply:Framed-Protocol           := 'radiusFramedProtocol'
+                reply:Framed-IP-Address         := 'radiusFramedIPAddress'
+                reply:Framed-IP-Netmask         := 'radiusFramedIPNetmask'
+                reply:Framed-Route              := 'radiusFramedRoute'
+                reply:Framed-Routing            := 'radiusFramedRouting'
+                reply:Filter-Id                 := 'radiusFilterId'
+                reply:Framed-MTU                := 'radiusFramedMTU'
+                reply:Framed-Compression        := 'radiusFramedCompression'
+                reply:Login-IP-Host             := 'radiusLoginIPHost'
+                reply:Login-Service             := 'radiusLoginService'
+                reply:Login-TCP-Port            := 'radiusLoginTCPPort'
+                reply:Callback-Number           := 'radiusCallbackNumber'
+                reply:Callback-Id               := 'radiusCallbackId'
+                reply:Framed-IPX-Network        := 'radiusFramedIPXNetwork'
+                reply:Class                     := 'radiusClass'
+                reply:Session-Timeout           := 'radiusSessionTimeout'
+                reply:Idle-Timeout              := 'radiusIdleTimeout'
+                reply:Termination-Action        := 'radiusTerminationAction'
+                reply:Login-LAT-Service         := 'radiusLoginLATService'
+                reply:Login-LAT-Node            := 'radiusLoginLATNode'
+                reply:Login-LAT-Group           := 'radiusLoginLATGroup'
+                reply:Framed-AppleTalk-Link     := 'radiusFramedAppleTalkLink'
+                reply:Framed-AppleTalk-Network  := 'radiusFramedAppleTalkNetwork'
+                reply:Framed-AppleTalk-Zone     := 'radiusFramedAppleTalkZone'
+                reply:Port-Limit                := 'radiusPortLimit'
+                reply:Login-LAT-Port            := 'radiusLoginLATPort'
+                reply:Reply-Message             := 'radiusReplyMessage'
+                reply:Tunnel-Type               := 'radiusTunnelType'
+                reply:Tunnel-Medium-Type        := 'radiusTunnelMediumType'
+                reply:Tunnel-Private-Group-Id   := 'radiusTunnelPrivateGroupId'
                 control:                        += 'radiusControlAttribute'
                 request:                        += 'radiusRequestAttribute'
                 reply:                          += 'radiusReplyAttribute'
         }
         user {
                 base_dn = "${..base_dn}"
-                filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
+{%     if helpers.exists('OPNsense.freeradius.ldap.user_filter') and OPNsense.freeradius.ldap.user_filter != '' %}
+                filter = "{{ OPNsense.freeradius.ldap.user_filter }}"
+{%     endif %}
                 sasl {
                 }
         }
         group {
                 base_dn = "${..base_dn}"
+{%     if helpers.exists('OPNsense.freeradius.ldap.group_filter') and OPNsense.freeradius.ldap.group_filter != '' %}
                 filter = '(objectClass=posixGroup)'
+{%     endif %}
                 membership_attribute = 'memberOf'
         }
         profile {
@@ -111,6 +157,5 @@ ldap {
         }
 
 }
-{%   endraw %}
 {%   endif %}
 {% endif %}
diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default
index dc3c6bec3..5dd630e5e 100644
--- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default
+++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default
@@ -58,6 +58,11 @@ authorize {
         -sql
 {% if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %}
         ldap
+        if ((ok || updated) && User-Password) {
+            update control {
+                Auth-Type := ldap
+            }
+        }
 {% else %}
         -ldap
 {% endif %}