<HTML>
<BODY>
Freeradius Server v2.1.4. All clients are authenticating properly, except for clients that pass a ntdomain\userid. I have configured proxy.conf, realm and inner-tunnel in the past (i.e. v2.0.5) to handle these requests without issue. As of v2.0.6 and greater, clients are no longer authenticating. The debug logs seem to indicate login success. WinXP SP3 wireless client using latest IBM Thinkvantage software.<br>
<br>
--- debug log ---<br>
rad_recv: Access-Request packet from host 10.5.251.2 port 1645, id=191, length=248<br>
User-Name = "SMBDOM\\userid"<br>
Framed-MTU = 1400<br>
Called-Station-Id = "0017.0fdd.e701"<br>
Calling-Station-Id = "0005.4e41.ec86"<br>
Service-Type = Login-User<br>
Message-Authenticator = 0xacbf72d2001dfb409e9924fcdc973b1f<br>
EAP-Message = 0x02090050190017030100203438196b413d6f8f767ff2592331e9f6327862d45efe5ed8084bb77a96c2987c1703010020182885154796afcf433e43f64e253e3960dd238a412d6fa974474d9da1a75899<br>
NAS-Port-Type = Wireless-802.11<br>
NAS-Port = 1674<br>
NAS-Port-Id = "1674"<br>
State = 0xb2e30b4db5ea124aad52ba89ddbd4668<br>
NAS-IP-Address = 10.5.251.2<br>
NAS-Identifier = "head_office_wireless_2"<br>
- entering group authorize {...}<br>
[preprocess] returns ok<br>
[chap] returns noop<br>
[mschap] returns noop<br>
[suffix] No '@' in User-Name = "SMBDOM\userid", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
[suffix] returns noop<br>
[SMBDOM] Looking up realm "SMBDOM" for User-Name = "SMBDOM\userid"<br>
[SMBDOM] Found realm "SMBDOM"<br>
[SMBDOM] Adding Stripped-User-Name = "userid"<br>
[SMBDOM] Adding Realm = "SMBDOM"<br>
[SMBDOM] Authentication realm is LOCAL.<br>
[SMBDOM] returns ok<br>
[eap] EAP packet type response id 9 length 80<br>
[eap] Continuing tunnel setup.<br>
[eap] returns ok<br>
Found Auth-Type = EAP<br>
- entering group authenticate {...}<br>
[eap] Request found, released from the list<br>
[eap] EAP/peap<br>
[eap] processing type peap<br>
[peap] processing EAP-TLS<br>
[peap] eaptls_verify returned 7<br>
[peap] Done initial handshake<br>
[peap] eaptls_process returned 7<br>
[peap] EAPTLS_OK<br>
[peap] Session established. Decoding tunneled attributes.<br>
[peap] EAP type mschapv2<br>
[peap] Got tunneled request<br>
EAP-Message = 0x020900061a03<br>
server {<br>
PEAP: Setting User-Name to SMBDOM\userid<br>
Sending tunneled request<br>
EAP-Message = 0x020900061a03<br>
FreeRADIUS-Proxied-To = 127.0.0.1<br>
User-Name = "SMBDOM\\userid"<br>
State = 0xa2f7c944a3fed33462945b4e374f79ce<br>
server inner-tunnel {<br>
- entering group authorize {...}<br>
[chap] returns noop<br>
[mschap] returns noop<br>
[unix] returns notfound<br>
[suffix] No '@' in User-Name = "SMBDOM\userid", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
[suffix] returns noop<br>
[SMBDOM] Looking up realm "SMBDOM" for User-Name = "SMBDOM\userid"<br>
[SMBDOM] Found realm "SMBDOM"<br>
[SMBDOM] Adding Stripped-User-Name = "userid"<br>
[SMBDOM] Adding Realm = "SMBDOM"<br>
[SMBDOM] Authentication realm is LOCAL.<br>
[SMBDOM] returns ok<br>
[control] returns ok<br>
[eap] EAP packet type response id 9 length 6<br>
[eap] No EAP Start, assuming it's an on-going EAP conversation<br>
[eap] returns updated<br>
[files] users: Matched entry userid at line 1385<br>
[files] returns ok<br>
[expiration] returns noop<br>
[logintime] returns noop<br>
[pap] Found existing Auth-Type, not changing it.<br>
[pap] returns noop<br>
Found Auth-Type = EAP<br>
- entering group authenticate {...}<br>
[eap] Request found, released from the list<br>
[eap] EAP/mschapv2<br>
[eap] processing type mschapv2<br>
[eap] Freeing handler<br>
[eap] returns ok<br>
Login OK: [SMBDOM\\userid] (from client private-network-5 port 0 via TLS tunnel)<br>
} # server inner-tunnel<br>
[peap] Got tunneled reply code 2<br>
Service-Type = Framed-User<br>
Framed-Protocol = PPP<br>
Framed-IP-Address = 255.255.255.254<br>
EAP-Message = 0x03090004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
User-Name = "userid"<br>
[peap] Got tunneled reply RADIUS code 2<br>
Service-Type = Framed-User<br>
Framed-Protocol = PPP<br>
Framed-IP-Address = 255.255.255.254<br>
EAP-Message = 0x03090004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
User-Name = "userid"<br>
[peap] Tunneled authentication was successful.<br>
[peap] SUCCESS<br>
[eap] returns handled<br>
Sending Access-Challenge of id 191 to 10.5.251.2 port 1645<br>
EAP-Message = 0x010a002b19001703010020b5c3cd4e27abb67bc4536c0829ed6f45c07edbfb2f42c758649472d7b8857cb2<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xb2e30b4dbae9124aad52ba89ddbd4668<br>
Finished request 8.<br>
--- end debug log ---<br>
<br>
Thanks for any assisantance
</BODY></HTML>