Thanks for pointing those things out to me. I am no longer proxying back to myself like that, and I've told the sql module to use stripped user name when possible and it looks like it's all working now. Best wishes, Chris ________________________________________ From: freeradius-users-bounces+cmanigan=towerstream.com@lists.freeradius.org [freeradius-users-bounces+cmanigan=towerstream.com@lists.freeradius.org] on behalf of Phil Mayers [p.mayers@imperial.ac.uk] Sent: Thursday, June 28, 2012 12:49 PM To: freeradius-users@lists.freeradius.org Subject: Re: EAP fails when proxying to a realm On 28/06/12 17:33, Christopher Manigan wrote:
I am trying to use MSCHAPv2 to authenticate users. This works ok, except when I try to proxy to a realm. Pasted below is the debug of a user trying to authenticate. The realm is a prefix of the username. What I see buried in the debug is:
# radiusd -X FreeRADIUS Version 2.1.11, for host i686-pc-linux-gnu, built on Jun 28 2012 at 11:37:39
Upgrade to 2.1.12 if possible
Sending Access-Request of id 22 to 127.0.0.1 port 1812
Why on earth are you proxying back to yourself, to the same virtual server no less? I suspect this is confusing the server, since it fails inside the handler further down.
[eap] Identity does not match User-Name, setting from EAP Identity.
[eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user.
You are rewriting the username. This doesn't work with EAP. Don't do that. If you need to strip realms etc. use "Stripped-User-Name". Leave the original username alone. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html