Hi,
Using the default eap/peap & inner-tunnel configuration, a failure gives rise to
this:

Exec-Program output: Logon failure (0xc000006d) 
Exec-Program-Wait: plaintext: Logon failure (0xc000006d) 
Exec-Program: returned: 1
[mschap] External script failed.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
} # server inner-tunnel
[peap] Got tunneled reply code 3
	MS-CHAP-Error = "\nE=691 R=1"
	EAP-Message = 0x040a0004
	Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
	MS-CHAP-Error = "\nE=691 R=1"
	EAP-Message = 0x040a0004
	Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled

How can I take that MS-Chap-Error attribute and pass it back in the final
access-reject, as a Reply-Message attribute for example.

Cheers
--Mike

