Radius LDAP auth for memberOf only accepts 1st memberOf - active-directory

Question

I have a Windows AD in lab and I'm messing with RADIUS post-auth for 802.1x auth to my lab switch.
The issue:
I created a test user "user001" and gave it membership to 3 groups:
CN=VpnAuthorizedUsers,OU=mygroups,DC=mydomain,DC=local
CN=LocalAdmin,CN=Users,DC=mydomain,DC=local
CN=dev,OU=mygroups,DC=mydomain,DC=local
I want to allow CN:LocalAdmin priv level 15 to switch. My post-auth works perfectly for this if CN:LocalAdmin is the 1st memberOf offer, but as in the below debug output it sees it but says "FALSE" in the control group...
My RADIUS mods-enabled ldap entry
update {
control:My_Group += 'memberOf'
control: += 'radiusControlAttribute'
request: += 'radiusRequestAttribute'
reply: += 'radiusReplyAttribute'
}
My RADIUS inner-tunnel post auth entry :
post-auth {
if (&control:My_Group =~ /CN=LocalAdmin,CN=Users,DC=mydomain,DC=local/) {
update reply {
Cisco-AVPair = "shell:priv-lvl=15"
}
}
Debug radiusd -X output:
(0) Received Access-Request Id 43 from 192.168.1.9:3175 to 192.168.1.70:1812 length 72
(0) User-Name = "user001"
(0) User-Password = "userpass"
(0) NAS-IP-Address = 192.168.1.9
(0) Message-Authenticator = 0x4321abcd1234efgh5678
(0) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel
(0) authorize {
rlm_ldap (ldap): Reserved connection (0)
(0) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})
(0) ldap: --> (sAMAccountName=user001)
(0) ldap: Performing search in "OU=myusers,DC=mydomain,DC=local" with filter "(sAMAccountName=user001)", scope "sub"
(0) ldap: Waiting for search result...
(0) ldap: User object found at DN "CN=user001,OU=Developer,OU=Approved,OU=myusers,DC=mydomain,DC=local"
(0) ldap: Processing user attributes
(0) ldap: control:My_Group += 'CN=VpnAuthorizedUsers,OU=mygroups,DC=mydomain,DC=local'
(0) ldap: control:My_Group += 'CN=LocalAdmin,CN=Users,DC=mydomain,DC=local/'
(0) ldap: control:My_Group += 'CN=dev,OU=mygroups,DC=mydomain,DC=local'
(0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute
(0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)
rlm_ldap (ldap): Released connection (0)
Need 5 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used
rlm_ldap (ldap): Connecting to ldaps://dc1.mydomain.com:636 ldaps://dc2.mydomain.com:636
TLSMC: MozNSS compatibility interception begins.
tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present.
tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only.
TLSMC: MozNSS compatibility interception ends.
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(0) [ldap] = updated
(0) if (ok || updated) {
(0) if (ok || updated) -> TRUE
(0) if (ok || updated) {
(0) update control {
(0) Auth-Type := LDAP
(0) } # update control = noop
(0) } # if (ok || updated) = noop
(0) } # authorize = updated
(0) Found Auth-Type = LDAP
(0) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(0) Auth-Type LDAP {
rlm_ldap (ldap): Reserved connection (1)
(0) ldap: Login attempt by "user001"
(0) ldap: Using user DN from request "CN=user001,OU=myusers,DC=mydomain,DC=local"
(0) ldap: Waiting for bind result...
(0) ldap: Bind successful
(0) ldap: Bind as user "CN=user001,OU=myusers,DC=mydomain,DC=local" was successful
rlm_ldap (ldap): Released connection (1)
(0) [ldap] = ok
(0) } # Auth-Type LDAP = ok
(0) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel
(0) post-auth {
(0) if (&control:My_Group =~ /CN=LocalAdmin,CN=Users,DC=mydomain,DC=local/) {
(0) if (&control:My_Group =~ /CN=LocalAdmin,CN=Users,DC=mydomain,DC=local/) -> FALSE
(0) } # post-auth = noop
(0) Sent Access-Accept Id 43 from 192.168.1.70:1812 to 192.168.1.9:53175 length 0
(0) Finished request
Waking up in 4.9 seconds.
(0) Cleaning up request packet ID 43 with timestamp +11
Ready to process requests
Can anyone at StackOverflow tell me why radius is showing "-> FALSE" when it clearly is not? If I delete the other group memberships and re-enter them AFTER LocalAdmin it works. I want radius post-auth to pick out group memberships no matter what order they appear in ldap.