Reasons for "MS-CHAP2-Response is incorrect"

[Sven Hartge]

On 12.07.19 15:58, Alan DeKok wrote:
> On Jul 12, 2019, at 10:10 AM, Sven Hartge <sven at svenhartge.de> wrote:

>> The 1st level support group here has asked me to clarify the reasons
>> behind authentication errors where the message is "mschap:
>> MS-CHAP2-Response is incorrect" so they can better point the end users
>> in the right direction.
>>
>> The obvious one is of course "wrong password", another one is "mucking
>> about with the Username in the RADIUS server" (which I don't do).
>>
>> What other reasons are there for this error type to occur?
> 
>   Pretty much just those two.
> 
>   Other options are things like "calculating MS-CHAP wrong", which some systems do.  But not FreeRADIUS. :)

It's about 25% Linux, 25% Windows, 25% Android and 25% iOS here, with
some rounding errors at the edges.

I gather the chances of any of those major 4 doing something wrong are
close to zero.

Which then reinforces my view that any "MS-CHAP2-Response is incorrect"
error has to be a wrong password, whether the user believes it or not.

Thanks Alan.

Grüße,
Sven.