What is a difference "Auth-Type eap"(with Auth-Type) and "eap"(without Auth-Type) in the "authenticate" section?

[Alan DeKok]

On Feb 19, 2019, at 7:47 AM, Hiroyuki Sato <hiroysato at gmail.com> wrote:
> 
> Could you tell me what is a difference  "Auth-Type eap"(with Auth-Type) and
> "eap"(without Auth-Type)  in the "authenticate" section? Below is an example.
> What document should I read?

  https://networkradius.com/doc/FreeRADIUS-Technical-Guide.pdf

  Listing "eap" in the "authenticate" section just runs the "eap" module.

  If you want *multiple* things done in the "authenticate" section, you have to put them in an "Auth-Type ..." block.

>  (2) EAP
>  authenticate {
> 
>    eap
> 
>    #
>    #  The older configurations sent a number of attributes in
>    #  Access-Challenge packets, which wasn't strictly correct.
>    #  If you want to filter out these attributes, uncomment
>    #  the following lines.
>    #
>   Auth-Type eap {

  That section is commented-out in the default configuration.  You can only use *one* of "eap" or "Auth-Type eap { ...}" in the "authenticate" section.

  Alan DeKok.