I would like ntlm_auth failure reasons more visible so our help desk can assist users who are having trouble authenticating.  Currently, rlm_ldap creates a request attribute called “Module-Failure-Message” on some types of errors (e.g., user not found).  I created a small patch for rlm_mschap that creates the same request attribute with the output from ntlm_auth if authentication fails.  (Before someone asks how this lets our help desk see the information, I have written a post-auth perl script that captures this and other attributes and writes them to a custom log file.  Our help desk then uses a viewer utility I wrote to search/display the logs.)

I have a similar desire to capture SSL negotiation failure reasons in our logs.  I have created another patch to capture these failures as well although it is currently against FR 1.1.2.  If there’s interest, I can integrate this change to CVS head and submit it as well.

Below is the rlm_mschap patch for your review and comment.  This was made against the CVS head I checked out on Oct. 12.

Thanks for your time and consideration.

--- src/modules/rlm_mschap/rlm_mschap.c.orig    Tue Oct  3 17:46:50 2006

+++ src/modules/rlm_mschap/rlm_mschap.c Thu Oct 12 15:32:04 2006

@@ -786,6 +786,9 @@

        } else {                /* run ntlm_auth */

                int     result;

                char    buffer[256];

+               VALUE_PAIR      *module_fmsg_vp;

+               char    module_fmsg[MAX_STRING_LEN];

+               int             module_fmsg_lastchr = 0;

                memset(nthashhash, 0, 16);

@@ -798,6 +801,13 @@

                                             NULL, NULL, 1);

                if (result != 0) {

                        DEBUG2("  rlm_mschap: External script failed.");

+                       snprintf(module_fmsg, sizeof(module_fmsg), "rlm_mschap: %s", buffer);

+                       module_fmsg_lastchr = strlen(module_fmsg)-1;

+                       if (module_fmsg[module_fmsg_lastchr] = '\n') {

+                               module_fmsg[module_fmsg_lastchr] = '\0';

+                       }

+                       module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ);

+                       pairadd(&request->packet->vps, module_fmsg_vp);

                        return -1;

                }