Thread continued from freeradius-users list..

As I mentioned previously, I have the PEAP changes completed to save/retrieve reply attributes on authentication failure.

I’ve examined the TTLS code and I have a question.  The code to retrieve the saved reply attributes is done in a different place in the authenticate function as compared to the PEAP code.  I’m wondering if this was intentional?  If not, do you see a problem moving this code from the switch on status == EAPTLS_SUCCESS to the switch on rcode == PW_AUTHENTICATION_ACK (which was changed from RLM_MODULE_OK in ttls.c:eapttls_process)?  I would then add similar code to the rcode == PW_AUTHENTICATION_REJECT to retrieve the saved reply attributes.  Alternatively, I could add EAPTLS_FAIL to the switch on status and retrieve the attributes in that block (and then return 0 as it does in the default block).

I’m looking for some advice because I have no way of testing/debugging the TTLS code and I’m concerned about breaking it.  I’m also concerned because the code in the switch on status “returns” on EAPTLS_SUCCESS in rlm_eap_ttls whereas it falls through in rlm_eap_peap to the switch on rcode (TTLS only falls through when status == EAPTLS_OK).

Thanks..