Hi, list I have no samba installed in my linux. 1.freeradius + AD : When I user radtest tool to test user/password on Win2k3/AD, I can get correct answer when I set authenticate type to ldap too. 2.eap/peap + 8021x + freeradius + openldap: Success. 3.eap/peap + 8021x + freeradius + Win2k3/AD When I auth the Winxp user access to switch. It failed. Even if I set Authenticate type to ldap or not, why?? rad_recv: Access-Request packet from host 10.155.20.84:1077, id=179, length=206 User-Name = "hwang" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hiveos" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0237002b19001703010020ee2ceed58c0ee38c2943f392498a1d0ce71f57156ed1e81ea1ae15ad61a5f53b State = 0x00bebc716634b88b8ea1ecd2216ccf25 Message-Authenticator = 0xec79f9c13e33bd20c35a6a6a7d6f291d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 65 modcall[authorize]: module "mschap" returns noop for request 65 rlm_realm: No '@' in User-Name = "hwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 65 rlm_eap: EAP packet type response id 55 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 65 rlm_ldap: - authorize rlm_ldap: performing user authorization for hwang radius_xlat: '(cn=hwang)' radius_xlat: 'cn=users,dc=aehve,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=users,dc=aehve,dc=com, with filter (cn=hwang) rlm_ldap: checking if remote access for hwang is allowed by cn rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user hwang authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 65 modcall: leaving group authorize (returns updated) for request 65 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 65 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 65 modcall: leaving group authenticate (returns invalid) for request 65 auth: Failed to validate the user. Sending Access-Reject of id 179 to 10.155.20.84 port 1077 EAP-Message = 0x04370004 Thanks! John --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！