PEAP problem when using domain suffix

[Alan DeKok]

Graham Marsh wrote:
> The results I posted in the original message were generated using the
> Odyssey Access Client, I apologise for not mentioning that first. So
> with OAC, the username without suffix works, with suffix fails.
...
> Anyway, the interesting thing is that when the native client in XP SP3
> is used with or without suffix, it works in both cases.

  i.e. the Odyssey client does something different from what the native
Windows supplicant does.

  Odyssey is broken.

  Given the number of people using it, I don't think that they will fix
it.  The only way around this is to update the configuration in the
"authenticate" section to try a second method of calculating the MS-CHAP
response, if the first method fails.  Ugh.

  Alan DeKok.