Thanks to the guidance in the discussion above, I got this to work using Windows Server 2012 R2 NPS. I have a very specific use case where I have some hospitality-type APs (HP 527's) with passthrough ports; I needed the switch to automatically tag through the VLANs I might need on the switch ports on the 527.
The attributes in RFC 4675 are RADIUS-Standard attributes; no amount of tinkering with vendor-specific attributes (which is actually atribute ID 26) will cause them to be passed to the switch correctly - unless you're using the pre-standard ProCurve attributes. It would therefore seem that the only way to expose the option in the GUI is to hack the dnary.xml file.
This modification described here is of course totally unsupported by Microsoft, and implementing it may cause a rip in the space-time continuum. Or not.
If you do go ahead with hacking away at dnary.xml, MAKE A BACKUP BEFORE YOU MAKE ANY CHANGES!
I added the bit below to the dnary.xml file on my 2012 R2 server. I'm not sure whether it makes a difference where you place the text, as long as it's at the same level as the other Attribute entries. It made sense to me to put it between attributes 56 & 60. (Yes, I had to reboot for it to take effect; not sure how else to trigger a reload of the dnary.xml file.)
<Attribute>
<ID>56</ID>
<Name>Egress-VLANID</Name>
<Syntax>OctetString</Syntax>
<MultiValued>1</MultiValued>
<Is-Security-Sensitive>0</Is-Security-Sensitive>
<IsAllowedInProfile>1</IsAllowedInProfile>
<IsAllowedInCondition>0</IsAllowedInCondition>
<IsAllowedInProxyProfile>1</IsAllowedInProxyProfile>
<IsAllowedInProxyCondition>0</IsAllowedInProxyCondition>
<LDAPName>msRADIUSEgress-VLANID</LDAPName>
<IsTunnelAttribute>0</IsTunnelAttribute>
</Attribute>
Once in place, I was able to add the Egress-VLANID attribute as a setting under Standard RADIUS attributes, and add multiple tagged VLANs inside it. For my specific use case I used it in the Connection Request Policy, but the settings can be set in a Network Policy as well. The 2530 ProCurve switch I used this on happily accepted and applied the values, provided *all* the VLANs are defined on the switch. I will be testing more on Comware soon; the HP 830 Unified-WLAN I tested on did not seem to support RFC 4675, but the manuals for the 5120 (Comware 5) and 5130 (Comware 7) do explicitly mention RFC 4675 compliance so I'm hopeful they'll work.
In the screenshots below, I set the PVID and Untagged VLAN to 500, and tag VLANs 501, 502, 504, 506, 508, 510, 511 and 512.
