Unlike previous behaviour, post auth { Post-Auth-Type REJECT { ... } } does not get found and called in 3.1.x - you get (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) Post-Auth-Type Reject sub-section not found. Using default return values. If it's changed to Post-Auth-Type Reject { then all is fine. This broke in commit 0b2e4da0c574dedd9309c9dbbdf4f8cb9d869d27 Author: Alan T. DeKok <aland@freeradius.org> Date: Tue May 24 17:00:29 2016 -0400 Use CONF_SECTIONs directly in unlang_interpret The easiest fix is to change the default config to be "Reject" rather than "REJECT", but that will seemingly unnecessarily break configs when people upgrade from 3.0 so I'm not sure that's the best solution. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>