custom auth script just for pap

Christian Salway christian.salway at
Fri Nov 16 14:54:44 CET 2018

Hi Alan,

I have read all 58 pages of the Technical Guide and scanned through the "main page" (which is basically a copy).

I still don't know how to implement a custom authorisation.

What I am trying to achieve is to:

a) log in with eap-mschapv2 and only if Access-Accept, run a custom script to do an MFA which could cause the result to become an Access-Reject.
b) log in with pap and run a custom auth script (which does MFA) which results in an access-Accept or Reject.

I couldn't find anywhere in the documentation to help me with this.  Could you point me to the page?  I think I understand that it is probably best done in the Authenticate section

Christian Salway

> On 16 Nov 2018, at 11:45, Alan DeKok <aland at> wrote:
> On Nov 16, 2018, at 6:40 AM, Christian Salway via Freeradius-Users <freeradius-users at> wrote:
>> Does that go in authorize or authenticate?
>  At some point, it helps to understand the system you're configuring.  Read the technical guide here:
>  You shouldn't just ask a question every time you run into a problem.
>  Alan DeKok.
> -
> List info/subscribe/unsubscribe? See

More information about the Freeradius-Users mailing list