(config) #aaa derivation-rules user <udr-ruleset-name>
set role:
(user-rule) #set role condition <bssid,dhcp-option,dhcp-option-77,encryption-type,essid,location,macaddr> <contains,ends-with,equals,not-equals,starts-with> <value> set-value <role-name>
set vlan:
(user-rule) #set vlan condition <bssid,dhcp-option,dhcp-option-77,encryption-type,essid,location,macaddr> <contains,ends-with,equals,not-equals,starts-with> <value> set-value <vlan>
Keep in mind that this was not designed to be a registration-type feature. It was designed to take groups of devices that share common properties and assign a role (for example, the DHCP fingerprint of game consoles, or the MAC prefix of a VoIP phone). You may run into scalability issues.