Can someone please help provide a clue into the problems with using ntlm_auth in a Freeradius config running on Debian.

The user/password information are held in the LDAP server.  I have been able to authenticate successfully with packets coming from non-EAP clients.  But for EAP authentication clients, I have been receiving the following error lines.  (I am using ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} to call the LDAP server.

Found Auth-Type = EAP

+- entering group authenticate {...}

[eap] Request found, released from the list

[eap] EAP/mschapv2

[eap] processing type mschapv2

[mschapv2] +- entering group MS-CHAP {...}

[mschap] No Cleartext-Password configured.  Cannot create LM-Password.

[mschap] No Cleartext-Password configured.  Cannot create NT-Password.

[mschap] Told to do MS-CHAPv2 for otha1_00 with NT-Password

[mschap] WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details

[mschap] WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details

[mschap]        expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=otha1_00

[mschap]  mschap2: 18

[mschap]        expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b06bae6a129ec4e7

[mschap]        expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=c0bec1a04bdd9fb489ef30a2bc22e5806405493ac2038167

Exec-Program output: Invalid handle (0xc0000008)

Exec-Program-Wait: plaintext: Invalid handle (0xc0000008)

Exec-Program: returned: 1

[mschap] External script failed.

[mschap] FAILED: MS-CHAP2-Response is incorrect

++[mschap] returns reject

[eap] Freeing handler

++[eap] returns reject

Failed to authenticate the user.

} # server inner-tunnel

[peap] Got tunneled reply code 3

        MS-CHAP-Error = "\026E=691 R=1"

        EAP-Message = 0x04160004

        Message-Authenticator = 0x00000000000000000000000000000000

[peap] Got tunneled reply RADIUS code 3

        MS-CHAP-Error = "\026E=691 R=1"

        EAP-Message = 0x04160004

        Message-Authenticator = 0x00000000000000000000000000000000

[peap] Tunneled authentication was rejected. 

Clement