Hello everyone... Ive set up a freeradius server with LDAP backend for MSCHAP, but now I have to set up a mac based auth on the same server also with the same LDAP backend ( but the mac info is found in another subtree ). So I have made two ldap instances under modules including MSCHAP... modules { mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } ldap ldap_users { server = "81.yyy.xxx.xxx" basedn = "ou=People,dc=xxx,dc=xxx" filter = "(&(objectClass=posixAccount)(uid=%u))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 4 timelimit = 3 net_timeout = 1 } ldap ldap_mac { server = "81.xxx.xxx.xxx" basedn = "ou=Hosts,dc=xxx,dc=xxx" filter = "(&(objectClass=ipHost)(ipHostNumber=%u))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 4 timelimit = 3 net_timeout = 1 } ... } // modules end instantiate { weekly_traffic // just a counter } authorize { mschap ldap_users ldap_mac weekly_traffic } authenticate { # MSCHAP authentication. Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap_mac ldap_users } } So what I actually need is - when my vpn server sends Access-Request packets with MS-CHAP attributes, I would like mschap module to use the "ldap_users" part. And when an Access-Request packet with the mac address is recieved I would like to use ldap_mac ONLY ! here is a part of my log file... rad_recv: Access-Request packet from host 172.19.10.2:1024, id=22, length=193 Framed-MTU = 1480 NAS-IP-Address = 172.19.10.2 NAS-Identifier = "HP2626-Verwaltung" User-Name = "00:0a:e4:22:c5:9d" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 10 NAS-Port-Type = Ethernet NAS-Port-Id = "10" Called-Station-Id = "00-14-38-2e-2c-76" Calling-Station-Id = "00-0a-e4-22-c5-9d" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x1525d56e4e21bbbc83d5e49fa3be8173a5 Debug: Processing the authorize section of radiusd.conf Debug: modcall: entering group authorize for request 0 Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Debug: modcall[authorize]: module "mschap" returns noop for request 0 Debug: modsingle[authorize]: calling ldap_users (rlm_ldap) for request 0 Debug: rlm_ldap: - authorize Debug: rlm_ldap: performing user authorization for 00:0a:e4:22:c5:9d Debug: radius_xlat: '(&(objectClass=posixAccount)(uid=00:0a:e4:22:c5:9d))' Debug: radius_xlat: 'ou=People,dc=kolp,dc=at' Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Debug: rlm_ldap: attempting LDAP reconnection Debug: rlm_ldap: (re)connect to 81.189.101.10:389, authentication 0 Debug: rlm_ldap: bind as / to 81.189.101.10:389 Debug: rlm_ldap: waiting for bind result ... Debug: rlm_ldap: Bind was successful Debug: rlm_ldap: performing search in ou=People,dc=kolp,dc=at, with filter (&(objectClass=posixAccount)(uid=00:0a:e4:22:c5:9d)) Debug: rlm_ldap: object not found or got ambiguous search result Debug: rlm_ldap: search failed Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Debug: modsingle[authorize]: returned from ldap_users (rlm_ldap) for request 0 Debug: modcall[authorize]: module "ldap_users" returns notfound for request 0 Debug: modsingle[authorize]: calling ldap_mac (rlm_ldap) for request 0 Debug: rlm_ldap: - authorize Debug: rlm_ldap: performing user authorization for 00:0a:e4:22:c5:9d Debug: radius_xlat: '(&(objectClass=ipHost)(ipHostNumber=00:0a:e4:22:c5:9d))' Debug: radius_xlat: 'ou=Hosts,dc=kolp,dc=at' Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Debug: rlm_ldap: attempting LDAP reconnection Debug: rlm_ldap: (re)connect to 81.189.101.10:389, authentication 0 Debug: rlm_ldap: bind as / to 81.189.101.10:389 Debug: rlm_ldap: waiting for bind result ... Debug: rlm_ldap: Bind was successful Debug: rlm_ldap: performing search in ou=Hosts,dc=kolp,dc=at, with filter (&(objectClass=ipHost)(ipHostNumber=00:0a:e4:22:c5:9d)) Debug: rlm_ldap: looking for check items in directory... Debug: rlm_ldap: looking for reply items in directory... Debug: rlm_ldap: Adding description as vid, value 20 & op=11 Debug: rlm_ldap: user 00:0a:e4:22:c5:9d authorized to use remote access Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Debug: modsingle[authorize]: returned from ldap_mac (rlm_ldap) for request 0 Debug: modcall[authorize]: module "ldap_mac" returns ok for request 0 Debug: modsingle[authorize]: calling weekly_traffic (rlm_counter) for request 0 Debug: rlm_counter: Entering module authorize code Debug: rlm_counter: Could not find Check item value pair Debug: modsingle[authorize]: returned from weekly_traffic (rlm_counter) for request 0 Debug: modcall[authorize]: module "weekly_traffic" returns noop for request 0 Debug: modcall: group authorize returns ok for request 0 Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Sorry for the long mail :( Thank you in advance ! Regards, Edvin Seferovic