I'd say use ntlm_auth with 2 instances of MSCHAP module - using unlang and fail-through mechanism...so if MSCHAP instance 1 fails then it tries instance 2

We used this mechanism when migrating from one AD to another

alan

--
This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.