hi, heres your issue: [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel [mschapv2] +group MS-CHAP { [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: john@eduroam.example.edu [mschap] Client is using MS-CHAPv2 for john@eduroam.example.edu, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject +} # group MS-CHAP = reject [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. Login incorrect: [john@eduroam.example.edu/<via Auth-Type = EAP>] (from client network8 port 0 via TLS tunnel) Using Post-Auth-Type Reject as you can see, its not using Stripped-User-Name.... its using the User-Name thats why 'john' works and this "john@eduroam.example.edu" doesnt I'm guessing you have 'john' in your users file.... though you probably want to have that auth somewhere else anyway - in LDAP or AD.... alan