sorry, i ve got persistents problems :

- i filter client certificate under authenticate section (under eap) with : Auth-Type eap {
                        if ( "%{TLS-Client-Cert-Subject}" =~ /OU=xxxxx/ ) {
                                    reject
                                            }
        }.
Firstly, it s' written on "default" file :
 Please do not put "unlang" configurations into the "authenticate"
#  section.  Put them in the "post-auth" section instead.  That's what
#  the post-auth section is for.
But, according to me , it's not right because i don't want to enter into post-auth. It must be rejected before.

secondly,

with this configuration, i try to authenticate a client with certificate OU=xxxxx. According to mode debug, it seemed to work. Client (windows XP) requested 21 times without sucess. But at 22nd, it seemed authenticate sucessful because i see client which is associated to AP. after times (5-10 minutes), Client seemed to be detached and entered in authenticating loop until succeed authenticating.

do you know why client success authenticating for a time ?
Is it possible to avoid request of certain client  ?
I restrict authentication request to chooser NAS. I want to avoid clients to enter loop authentication. But these client can request authentication through NAS choosen.

Cheers.