On Jan 19, 2016, at 3:39 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
I'm probably fairly unusual in having an eap instantiation (two even) that's not called "eap".
I've done some more spelunking, and calling the "eap" module is only done when it's proxying the inner-tunnel EAP data. I've pushed fixes which convert the error into a WARNING, which won't break existing configurations.
TBH I've never quite got my head around why there is e.g.
Auth-Type pap { pap }
for everything else, and just
eap
for the eap module. I've always guessed that if the correct Auth-Type section is set then it uses that section, otherwise it just goes an calls all modules not in a named section in order (as in authorize) and hopes that something picks it up?
It doesn't make much difference. Auth-Type pap { pap } is the same as just pap BUT using the Auth-Type wrapper lets you put policies into the section: Auth-Type back_door { if ((User-Name == "bob") && (User-Password == "bob")) { accept } else { pap } } :) Alan DeKok.