As another way rather than assigning the vlan from the radius server you could also just get the radius server to respond with a Filter-ID which contain the name of a role that is defined on the controller. The role would then have a VLAN assigned to it as part of the role configuration.