Freeradius and ldap attribute mismatch

17 Jul 2018

      Hi all,

We are in the process of migrating Freeradius in our production environment. The current version is way too old (running on Red Hat 3! seems like nobody really wanted to do the upgrade). Anyway, I finally managed to make authentication work. But I still have a problem. It looks like the client's device doesn't "receive" the Class attribute on the login process, even though I see it in the logs. You will see in the logs below that all LDAP attributes are passed on login. The only difference is that the Class attribute is in hexadecimal instead of text. From your expertise and knowhow, where could this error come from? Freeradius, Openldap or the client's device?

Thanks in advance. Here are the logs:

[Mon Jul 16 12:53:05 - root@flyers raddb]# radiusd -X
radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Jul 11 2017 at 04:40:14
Copyright (C) 1999-2013 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
For more information about these matters, see the file named COPYRIGHT.
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/modules/
including configuration file /etc/raddb/modules/replicate
including configuration file /etc/raddb/modules/always
including configuration file /etc/raddb/modules/radutmp
including configuration file /etc/raddb/modules/expiration
including configuration file /etc/raddb/modules/perl
including configuration file /etc/raddb/modules/digest
including configuration file /etc/raddb/modules/pam
including configuration file /etc/raddb/modules/attr_filter
including configuration file /etc/raddb/modules/counter
including configuration file /etc/raddb/modules/policy
including configuration file /etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /etc/raddb/modules/wimax
including configuration file /etc/raddb/modules/ldap
including configuration file /etc/raddb/modules/linelog
including configuration file /etc/raddb/modules/cache
including configuration file /etc/raddb/modules/realm
including configuration file /etc/raddb/modules/detail.example.com
including configuration file /etc/raddb/modules/mac2vlan
including configuration file /etc/raddb/modules/sql_log
including configuration file /etc/raddb/modules/passwd
including configuration file /etc/raddb/modules/cui
including configuration file /etc/raddb/modules/preprocess
including configuration file /etc/raddb/modules/inner-eap
including configuration file /etc/raddb/modules/detail.log
including configuration file /etc/raddb/modules/chap
including configuration file /etc/raddb/modules/detail
including configuration file /etc/raddb/modules/exec
including configuration file /etc/raddb/modules/rediswho
including configuration file /etc/raddb/modules/otp
including configuration file /etc/raddb/modules/opendirectory
including configuration file /etc/raddb/modules/ippool
including configuration file /etc/raddb/modules/etc_group
including configuration file /etc/raddb/modules/echo
including configuration file /etc/raddb/modules/redis
including configuration file /etc/raddb/modules/ntlm_auth
including configuration file /etc/raddb/modules/dhcp_sqlippool
including configuration file /etc/raddb/modules/radrelay
including configuration file /etc/raddb/modules/attr_rewrite
including configuration file /etc/raddb/modules/dynamic_clients
including configuration file /etc/raddb/modules/checkval
including configuration file /etc/raddb/modules/smsotp
including configuration file /etc/raddb/modules/expr
including configuration file /etc/raddb/modules/mac2ip
including configuration file /etc/raddb/modules/logintime
including configuration file /etc/raddb/modules/files
including configuration file /etc/raddb/modules/smbpasswd
including configuration file /etc/raddb/modules/mschap
including configuration file /etc/raddb/modules/acct_unique
including configuration file /etc/raddb/modules/unix
including configuration file /etc/raddb/modules/pap
including configuration file /etc/raddb/modules/sradutmp
including configuration file /etc/raddb/modules/soh
including configuration file /etc/raddb/eap.conf
including configuration file /etc/raddb/policy.conf
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/default
including configuration file /etc/raddb/sites-enabled/control-socket
including configuration file /etc/raddb/sites-enabled/inner-tunnel
main {
        user = "radiusd"
        group = "radiusd"
        allow_core_dumps = no
}
including dictionary file /etc/raddb/dictionary
main {
        name = "radiusd"
        prefix = "/usr"
        localstatedir = "/var"
        sbindir = "/usr/sbin"
        logdir = "/var/log/radius"
        run_dir = "/var/run/radiusd"
        libdir = "/usr/lib64/freeradius"
        radacctdir = "/var/log/radius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 1024
        pidfile = "/var/run/radiusd/radiusd.pid"
        checkrad = "/usr/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
 log {
        stripped_names = no
        auth = no
        auth_badpass = no
        auth_goodpass = no
 }
 security {
        max_attributes = 200
        reject_delay = 1
        status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
        retry_delay = 5
        retry_count = 3
        default_fallback = yes
        dead_time = 300
        wake_all_if_all_dead = no
 }
 realm contivity {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-intranetprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-mediaprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-gestionprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-caissesprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-appprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-privprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-pubprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-extranetprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-stadprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ogr-gestionprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm srv-gestionprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm stadprod.dsd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ssl3050 {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.dsd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ssl-teleacces.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ssl-notes.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-fidprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm isb-intranetprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bce-gestionpe.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm mobilite-cfe.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm devmobilite-cfe.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ssl-admin.bell {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm caissesprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod-siebel.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm stadprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm caissesdev.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetdev.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privdev.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestiondev.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm fidprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm devmobilite-caissesuni.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appval-siebel.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appdev.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod-crypto.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ssl-oper {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm sniffer {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm mobilite-caisses.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm devmobilite-caisses.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.ccd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appval-releve.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod.fcpa {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod.fidvisa {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod.scd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod01.scd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionpe.scd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionprod.ccd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetcdc.cdc {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.altel {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.ce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.sped {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privprod.fcpa {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privprod.sirius {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm stadprod.cad {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm caissesprod1.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod.vmd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privprod-google.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm supportoracle.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionval.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod02.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionprod-ddcsc.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ibmaccess {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod-t.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm xentrax-stadprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm xentrax-intranetprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bell01-stadprod.bce {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod03.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm css.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestion.hds {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm appprod04.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm rr.partenaires {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privprod.panagon {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm byoc.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ccc.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm support-ddtcpc.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.dcr {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm meplus.ccd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm campus.jacada {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm support-ddcsc.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm support.controles.ac {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm contivity {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm contivity
 realm bce-intranetprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-intranetprod.bce
 realm bce-mediaprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-mediaprod.bce
 realm bce-gestionprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-gestionprod.bce
 realm bce-caissesprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-caissesprod.bce
 realm bce-appprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-appprod.bce
 realm bce-privprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-privprod.bce
 realm bce-pubprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-pubprod.bce
 realm bce-extranetprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-extranetprod.bce
 realm bce-stadprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-stadprod.bce
 realm ogr-gestionprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ogr-gestionprod.bce
 realm srv-gestionprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm srv-gestionprod.bce
 realm stadprod.dsd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm stadprod.dsd
 realm intranetprod.dsd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.dsd
 realm ssl3050 {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ssl3050
 realm ssl-teleacces.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ssl-teleacces.fcdq
 realm ssl-notes.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ssl-notes.fcdq
 realm bce-fidprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-fidprod.bce
 realm isb-intranetprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm isb-intranetprod.fcdq
 realm bce-gestionpe.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bce-gestionpe.bce
 realm mobilite-cfe.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm mobilite-cfe.fcdq
 realm devmobilite-cfe.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm devmobilite-cfe.fcdq
 realm ssl-admin.bell {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ssl-admin.bell
 realm ssl-oper {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ssl-oper
 realm intranetprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.fcdq
 realm gestionprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.fcdq
 realm caissesprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm caissesprod.fcdq
 realm appprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod.fcdq
 realm privprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privprod.fcdq
 realm appprod-siebel.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod-siebel.fcdq
 realm stadprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm stadprod.fcdq
 realm caissesdev.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm caissesdev.fcdq
 realm intranetdev.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetdev.fcdq
 realm privdev.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privdev.fcdq
 realm gestiondev.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm gestiondev.fcdq
 realm fidprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm fidprod.fcdq
 realm devmobilite-caissesuni.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm devmobilite-caissesuni.fcdq
 realm appval-siebel.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appval-siebel.fcdq
 realm privprod-at.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 }
 realm privprod-at.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privprod-at.fcdq
 realm appdev.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appdev.fcdq
 realm appprod-crypto.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod-crypto.fcdq
 realm mobilite-caisses.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm mobilite-caisses.fcdq
 realm devmobilite-caisses.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm devmobilite-caisses.fcdq
 realm sniffer {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm sniffer
 realm intranetprod.ccd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.ccd
 realm appval-releve.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appval-releve.fcdq
 realm appprod.fcpa {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod.fcpa
 realm appprod.fidvisa {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod.fidvisa
 realm appprod.scd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod.scd
 realm appprod01.scd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod01.scd
 realm gestionpe.scd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm gestionpe.scd
 realm gestionprod.ccd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.ccd
 realm intranetcdc.cdc {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetcdc.cdc
 realm intranetprod.altel {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.altel
 realm intranetprod.ce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.ce
 realm intranetprod.sped {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.sped
 realm privprod.fcpa {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privprod.fcpa
 realm privprod.sirius {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privprod.sirius
 realm stadprod.cad {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm stadprod.cad
 realm caissesprod1.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm caissesprod1.fcdq
 realm appprod.vmd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod.vmd
 realm privprod-google.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privprod-google.fcdq
 realm supportoracle.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm supportoracle.fcdq
 realm gestionval.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm gestionval.fcdq
 realm appprod02.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod02.fcdq
 realm gestionprod-ddcsc.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod-ddcsc.fcdq
 realm ibmaccess {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ibmaccess
 realm intranetprod-t.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod-t.fcdq
 realm xentrax-stadprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm xentrax-stadprod.bce
 realm xentrax-intranetprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm xentrax-intranetprod.bce
 realm bell01-stadprod.bce {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm bell01-stadprod.bce
 realm appprod03.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod03.fcdq
 realm css.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm css.fcdq
 realm gestion.hds {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm gestion.hds
 realm appprod04.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm appprod04.fcdq
 realm rr.partenaires {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm rr.partenaires
 realm privprod.panagon {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privprod.panagon
 realm byoc.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm byoc.prod
 realm ccc.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ccc.prod
 realm support-ddtcpc.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm support-ddtcpc.fcdq
 realm intranetprod.dcr {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.dcr
 realm meplus.ccd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm meplus.ccd
 realm campus.jacada {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm campus.jacada
 realm support-ddcsc.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm support-ddcsc.fcdq
 realm support.controles.ac {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm support.controles.ac
 realm contivity {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm contivity
 realm bce-intranetprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-intranetprod.bce
 realm bce-mediaprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-mediaprod.bce
 realm bce-gestionprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-gestionprod.bce
 realm bce-caissesprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-caissesprod.bce
 realm bce-appprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-appprod.bce
 realm bce-privprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-privprod.bce
 realm bce-pubprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-pubprod.bce
 realm bce-extranetprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-extranetprod.bce
 realm bce-stadprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-stadprod.bce
 realm ogr-gestionprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ogr-gestionprod.bce
 realm srv-gestionprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm srv-gestionprod.bce
 realm stadprod.dsd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm stadprod.dsd
 realm intranetprod.dsd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.dsd
 realm ssl3050 {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ssl3050
 realm ssl-teleacces.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ssl-teleacces.fcdq
 realm ssl-notes.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ssl-notes.fcdq
 realm bce-fidprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-fidprod.bce
 realm isb-intranetprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm isb-intranetprod.fcdq
 realm bce-gestionpe.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bce-gestionpe.bce
 realm mobilite-cfe.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm mobilite-cfe.fcdq
 realm devmobilite-cfe.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm devmobilite-cfe.fcdq
 realm ssl-admin.bell {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ssl-admin.bell
 realm intranetprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.fcdq
 realm gestionprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.fcdq
 realm caissesprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm caissesprod.fcdq
 realm appprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod.fcdq
 realm privprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privprod.fcdq
 realm appprod-siebel.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod-siebel.fcdq
 realm stadprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm stadprod.fcdq
 realm caissesdev.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm caissesdev.fcdq
 realm intranetdev.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetdev.fcdq
 realm privdev.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privdev.fcdq
 realm gestiondev.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestiondev.fcdq
 realm fidprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm fidprod.fcdq
 realm devmobilite-caissesuni.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm devmobilite-caissesuni.fcdq
 realm appval-siebel.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appval-siebel.fcdq
 realm appdev.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appdev.fcdq
 realm appprod-crypto.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod-crypto.fcdq
 realm ssl-oper {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ssl-oper
 realm sniffer {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm sniffer
 realm mobilite-caisses.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm mobilite-caisses.fcdq
 realm devmobilite-caisses.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm devmobilite-caisses.fcdq
 realm intranetprod.ccd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.ccd
 realm appval-releve.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appval-releve.fcdq
 realm appprod.fcpa {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod.fcpa
 realm appprod.fidvisa {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod.fidvisa
 realm appprod.scd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod.scd
 realm appprod01.scd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod01.scd
 realm gestionpe.scd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionpe.scd
 realm gestionprod.ccd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.ccd
 realm intranetcdc.cdc {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetcdc.cdc
 realm intranetprod.altel {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.altel
 realm intranetprod.ce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.ce
 realm intranetprod.sped {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.sped
 realm privprod.fcpa {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privprod.fcpa
 realm privprod.sirius {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privprod.sirius
 realm stadprod.cad {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm stadprod.cad
 realm caissesprod1.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm caissesprod1.fcdq
 realm appprod.vmd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod.vmd
 realm privprod-google.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privprod-google.fcdq
 realm supportoracle.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm supportoracle.fcdq
 realm gestionval.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionval.fcdq
 realm appprod02.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod02.fcdq
 realm gestionprod-ddcsc.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod-ddcsc.fcdq
 realm ibmaccess {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ibmaccess
 realm intranetprod-t.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod-t.fcdq
 realm xentrax-stadprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm xentrax-stadprod.bce
 realm xentrax-intranetprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm xentrax-intranetprod.bce
 realm bell01-stadprod.bce {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bell01-stadprod.bce
 realm appprod03.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod03.fcdq
 realm css.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm css.fcdq
 realm gestion.hds {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestion.hds
 realm appprod04.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm appprod04.fcdq
 realm rr.partenaires {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm rr.partenaires
 realm privprod.panagon {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privprod.panagon
 realm byoc.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm byoc.prod
 realm ccc.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ccc.prod
 realm support-ddtcpc.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm support-ddtcpc.fcdq
 realm intranetprod.dcr {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.dcr
 realm meplus.ccd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm meplus.ccd
 realm campus.jacada {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm campus.jacada
 realm support-ddcsc.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm support-ddcsc.fcdq
 realm support-ddcsc.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm support-ddcsc.fcdq
 realm bellmarchesaffaires.bma {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm css.dgag {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm css.dsf {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm css.vmd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionpe.fid {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionprod.dgag {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionprod.dsf {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionprod.fid {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionprod.vmd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionscd.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionseed.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionseed.uni {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetdev.dgag {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetdev.dsf {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetdev.gmt {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetdev.ib-arm {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetdev-telip.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.blackbox {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.dlgl {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privprod.apisoft {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm prodgestion.ccd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm bellmarchesaffaires.bma {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm bellmarchesaffaires.bma
 realm css.dgag {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm css.dgag
 realm css.dsf {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm css.dsf
 realm css.vmd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm css.vmd
 realm gestionpe.fid {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionpe.fid
 realm gestionprod.dgag {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.dgag
 realm gestionprod.dsf {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.dsf
 realm gestionprod.fid {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.fid
 realm gestionprod.vmd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.vmd
 realm gestionscd.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionscd.prod
 realm gestionseed.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionseed.prod
 realm gestionseed.uni {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionseed.uni
 realm intranetdev.dgag {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetdev.dgag
 realm intranetdev.dsf {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetdev.dsf
 realm intranetdev.gmt {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetdev.gmt
 realm intranetdev.ib-arm {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetdev.ib-arm
 realm intranetdev-telip.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetdev-telip.fcdq
 realm intranetprod.blackbox {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.blackbox
 realm intranetprod.dlgl {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.dlgl
 realm privprod.apisoft {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privprod.apisoft
 realm prodgestion.ccd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm prodgestion.ccd
 realm IntranetPub.IBM {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm IntranetPub.IBM {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm IntranetPub.IBM
 realm IntranetPub.IBM {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm IntranetPub.IBM
 realm privappprod.decimal {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privappprod.decimal {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privappprod.decimal
 realm privappprod.decimal {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privappprod.decimal
 realm intranetprod.Novo {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.Novo {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.Novo
 realm intranetprod.Novo {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.Novo
 realm intranetprod.LetkoBrosseau {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.LetkoBrosseau {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.LetkoBrosseau
 realm intranetprod.LetkoBrosseau {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.LetkoBrosseau
 realm intranetprod.fid {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.fid {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.fid
 realm intranetprod.fid {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.fid
 realm extranetprod.Pirel {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm extranetprod.Pirel {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm extranetprod.Pirel
 realm extranetprod.Pirel {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm extranetprod.Pirel
 realm mailprod.dcr {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm mailprod.dcr {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm mailprod.dcr
 realm mailprod.dcr {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm mailprod.dcr
 realm Support.Equisoft {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm Support.Equisoft {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm Support.Equisoft
 realm Support.Equisoft {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm Support.Equisoft
 realm nsm {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm nsm {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm nsm
 realm nsm {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm nsm
 realm Nice.FCDQ {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm Nice.FCDQ {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm Nice.FCDQ
 realm Nice.FCDQ {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm Nice.FCDQ
 realm dmr-intranetprod.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm dmr-intranetprod.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm dmr-intranetprod.fcdq
 realm dmr-intranetprod.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm dmr-intranetprod.fcdq
 realm 4 {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm 4 {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm 4
 realm 4 {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm 4
 realm extranetprod.Eximius {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm extranetprod.Eximius {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm extranetprod.Eximius
 realm extranetprod.Eximius {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm extranetprod.Eximius
 realm espacevd.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm espacevd.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm espacevd.fcdq
 realm espacevd.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm espacevd.fcdq
 realm privconsomobile.dev {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privconsomobile.dev {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privconsomobile.dev
 realm privconsomobile.dev {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privconsomobile.dev
 realm unitraxdesj.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm unitraxdesj.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm unitraxdesj.prod
 realm unitraxdesj.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm unitraxdesj.prod
 realm Nuancegenesysdesj.mvt {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm Nuancegenesysdesj.mvt {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm Nuancegenesysdesj.mvt
 realm Nuancegenesysdesj.mvt {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm Nuancegenesysdesj.mvt
 realm komutel.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm komutel.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm komutel.prod
 realm komutel.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm komutel.prod
 realm Intranetdesj.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm Intranetdesj.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm Intranetdesj.prod
 realm Intranetdesj.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm Intranetdesj.prod
 realm webintranetdesj.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm webintranetdesj.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm webintranetdesj.prod
 realm webintranetdesj.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm webintranetdesj.prod
 realm caissectoecal.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm caissectoecal.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm caissectoecal.prod
 realm caissectoecal.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm caissectoecal.prod
 realm cssdesj.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm cssdesj.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm cssdesj.prod
 realm cssdesj.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm cssdesj.prod
 realm supportdesj.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm supportdesj.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm supportdesj.prod
 realm supportdesj.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm supportdesj.prod
 realm caissectodesj.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm caissectodesj.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm caissectodesj.prod
 realm caissectodesj.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm caissectodesj.prod
 realm nuancedesj.prod {
        authhost = 10.68.13.6:1645
        secret = xxxxxxx
 }
 realm nuancedesj.prod {
        authhost = 10.104.2.12:1645
        secret = xxxxxxx
 } # realm nuancedesj.prod
 realm nuancedesj.prod {
        authhost = 10.72.16.30:1645
        secret = xxxxxxx
 } # realm nuancedesj.prod
 realm intranetdev.scd {
        authhost = 10.68.13.6:1645
        secret = xxxxxxx
 }
 realm intranetdev.scd {
        authhost = 10.104.2.12:1645
        secret = xxxxxxx
 } # realm intranetdev.scd
 realm intranetdev.scd {
        authhost = 10.72.16.30:1645
        secret = xxxxxxx
 } # realm intranetdev.scd
 realm rcgt.prod {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm rcgt.prod {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm rcgt.prod
 realm rcgt.prod {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm rcgt.prod
 realm charybe {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm charybe {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm charybe
 realm charybe {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm charybe
 realm scylla {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm scylla {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm scylla
 realm scylla {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm scylla
 realm efront.dev {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm efront.dev {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm efront.dev
 realm efront.dev {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm efront.dev
 realm privprod.dlgl {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm privprod.dlgl {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm privprod.dlgl
 realm privprod.dlgl {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm privprod.dlgl
 realm stack.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm stack.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm stack.fcdq
 realm stack.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm stack.fcdq
 realm intranetprod.arrow {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.arrow {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.arrow
 realm intranetprod.arrow {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.arrow
 realm intranetprod.ipc {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.ipc {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.ipc
 realm intranetprod.ipc {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.ipc
 realm intranetprod.modex {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.modex {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.modex
 realm intranetprod.modex {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.modex
 realm intranetprod.niad {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.niad {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.niad
 realm intranetprod.niad {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.niad
 realm intranetprod.tradewest {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.tradewest {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.tradewest
 realm intranetprod.tradewest {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.tradewest
 realm solotech.vpni {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm solotech.vpni {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm solotech.vpni
 realm solotech.vpni {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm solotech.vpni
 realm dovetail.vpni {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm dovetail.vpni {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm dovetail.vpni
 realm dovetail.vpni {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm dovetail.vpni
 realm penega.vpni {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm penega.vpni {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm penega.vpni
 realm penega.vpni {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm penega.vpni
 realm gestionprod.bell.vpni {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm gestionprod.bell.vpni {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.bell.vpni
 realm gestionprod.bell.vpni {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm gestionprod.bell.vpni
 realm intranetprod.bell.vpni {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm intranetprod.bell.vpni {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.bell.vpni
 realm intranetprod.bell.vpni {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm intranetprod.bell.vpni
 realm murex.vpni {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm murex.vpni {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm murex.vpni
 realm murex.vpni {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm murex.vpni
 realm softtarget {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm softtarget {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm softtarget
 realm softtarget {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm softtarget
 realm mobilesprod.scd {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm mobilesprod.scd {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm mobilesprod.scd
 realm mobilesprod.scd {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm mobilesprod.scd
 realm fico {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm fico {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm fico
 realm fico {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm fico
 realm flexcubeccd.vpnz {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm flexcubeccd.vpnz {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm flexcubeccd.vpnz
 realm flexcubeccd.vpnz {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm flexcubeccd.vpnz
 realm oxilio {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm oxilio {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm oxilio
 realm oxilio {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm oxilio
 realm mobilesprod.scd.vpni {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm mobilesprod.scd.vpni {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm mobilesprod.scd.vpni
 realm mobilesprod.scd.vpni {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm mobilesprod.scd.vpni
 realm ccc.prod2 {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm ccc.prod2 {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm ccc.prod2
 realm ccc.prod2 {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm ccc.prod2
 realm SCDsupjrProd.fcdq.vpnz {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm SCDsupjrProd.fcdq.vpnz {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm SCDsupjrProd.fcdq.vpnz
 realm SCDsupjrProd.fcdq.vpnz {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm SCDsupjrProd.fcdq.vpnz
 realm archer.fcdq {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm archer.fcdq {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm archer.fcdq
 realm archer.fcdq {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm archer.fcdq
 realm extranetprod.sfl {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm extranetprod.sfl {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm extranetprod.sfl
 realm extranetprod.sfl {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm extranetprod.sfl
 realm q {
        authhost = 10.68.x.x:1645
        secret = xxxxxxx
 }
 realm q {
        authhost = 10.104.x.x:1645
        secret = xxxxxxx
 } # realm q
 realm q {
        authhost = 10.72.x.x:1645
        secret = xxxxxxx
 } # realm q
radiusd: #### Loading Clients ####
 client 127.0.0.1 {
        require_message_authenticator = no
        secret = "testing123"
        shortname = "localhost"
        nastype = "other"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "contivityicn"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "contivityfcdq"
 }
 Client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "contivityrel"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "shastaprod"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "shastaprod2"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "shastarel"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "shastarel2"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "sslvpnprod"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "contivitydmrprod"
 }
 client 10.233.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "contivityfidprod"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "contivityciaprod"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600INTRA3"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600INTRA"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600INTRa4A"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600INTRA2"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600CSE"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600APP"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600PUB"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "ssl3050"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600GEST"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600PRIV"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600STAD"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "8600DEV"
 }
 client x.x.x.xx {
        require_message_authenticator = no
        secret = "contivitycce4use"
        shortname = "contivitycceprod"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "asaprod"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxx"
        shortname = "SSLVPNMTL"
 }
 client 10.227.x.x {
        require_message_authenticator = no
        secret = "xxxxxxx"
        shortname = "SSLVPNTOR"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "infiniprod"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "nsmprodmtl"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "nsmprodtor"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client 10.254.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }

 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
 client x.x.x.x {
        require_message_authenticator = no
        secret = "xxxxxxxxx"
        shortname = "efficientip"
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating module "exec" from file /etc/raddb/modules/exec
  exec {
        wait = no
        input_pairs = "request"
        shell_escape = yes
        timeout = 10
  }
 Module: Linked to module rlm_expr
 Module: Instantiating module "expr" from file /etc/raddb/modules/expr
 Module: Linked to module rlm_expiration
 Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration
  expiration {
        reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime
  logintime {
        reply-message = "You are calling outside your allowed timespan  "
        minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server { # from file
 modules {
  Module: Creating Auth-Type = digest
  Module: Creating Auth-Type = LDAP
  Module: Creating Post-Auth-Type = REJECT
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating module "pap" from file /etc/raddb/modules/pap
  pap {
        encryption_scheme = "auto"
        auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating module "chap" from file /etc/raddb/modules/chap
 Module: Linked to module rlm_mschap
 Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap
  mschap {
        use_mppe = yes
        require_encryption = no
        require_strong = no
        with_ntdomain_hack = no
        allow_retry = yes
  }
 Module: Linked to module rlm_digest
 Module: Instantiating module "digest" from file /etc/raddb/modules/digest
 Module: Linked to module rlm_unix
 Module: Instantiating module "unix" from file /etc/raddb/modules/unix
  unix {
        radwtmp = "/var/log/radius/radwtmp"
  }
 Module: Linked to module rlm_ldap
 Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap
  ldap {
        server = "10.234.x.x4.16"
        port = 389
        password = "laboratoire"
        expect_password = yes
        identity = "cn=Manager,dc=connexim,dc=com"
        net_timeout = 1
        timeout = 4
        timelimit = 3
        max_uses = 0
        tls_mode = no
        start_tls = no
        tls_require_cert = "allow"
   tls {
        start_tls = no
        require_cert = "allow"
   }
        basedn = "dc=connexim,dc=com"
        filter = "(cn=%{User-Name})"
        base_filter = "(objectclass=radiusprofile)"
        auto_header = no
        access_attr_used_for_allow = yes
        groupname_attribute = "cn"
        groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
        dictionary_mapping = "/etc/raddb/ldap.attrmap"
        ldap_debug = 0
        ldap_connections_number = 5
        compare_check_items = no
        do_xlat = yes
        set_auth_type = yes
   keepalive {
        idle = 60
        probes = 3
        interval = 3
   }
  }
rlm_ldap: Registering ldap_groupcmp for Ldap-Group
rlm_ldap: Registering ldap_xlat with xlat_name ldap
rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password
rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusClientIPAddress mapped to RADIUS NAS-IP-Address
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
rlm_ldap: LDAP radiusLogin-Passport-8600 mapped to RADIUS Login-Passport-8600
rlm_ldap: LDAP radiusLogin-Sniffer-Cisco mapped to RADIUS Cisco-AVPair
rlm_ldap: LDAP radiusLogin-SSL-3050 mapped to RADIUS Login-SSL-3050
rlm_ldap: LDAP efficientip-groups mapped to RADIUS efficientip-groups
rlm_ldap: LDAP efficientip-first-name mapped to RADIUS efficientip-first-name
rlm_ldap: LDAP efficientip-last-name mapped to RADIUS efficientip-last-name
rlm_ldap: LDAP efficientip-pseudonym mapped to RADIUS efficientip-pseudonym
rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type
rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type
rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id
conns: 0x7f3e5a93cbe0
 Module: Linked to module rlm_eap
 Module: Instantiating module "eap" from file /etc/raddb/eap.conf
  eap {
        default_eap_type = "md5"
        timer_expire = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 1024
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
        challenge = "Password: "
        auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
        rsa_key_exchange = no
        dh_key_exchange = yes
        rsa_key_length = 512
        dh_key_length = 512
        verify_depth = 0
        CA_path = "/etc/raddb/certs"
        pem_file_type = yes
        private_key_file = "/etc/raddb/certs/server.pem"
        certificate_file = "/etc/raddb/certs/server.pem"
        CA_file = "/etc/raddb/certs/ca.pem"
        private_key_password = "whatever"
        dh_file = "/etc/raddb/certs/dh"
        fragment_size = 1024
        include_length = yes
        check_crl = no
        cipher_list = "DEFAULT"
        ecdh_curve = "prime256v1"
    cache {
        enable = no
        lifetime = 24
        max_entries = 255
    }
    verify {
    }
    ocsp {
        enable = no
        override_cert_url = yes
        url = "http://127.0.0.1/ocsp/"
        use_nonce = yes
        timeout = 0
        softfail = no
    }
   }
 Module: Linked to sub-module rlm_eap_ttls
 Module: Instantiating eap-ttls
   ttls {
        default_eap_type = "md5"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        virtual_server = "inner-tunnel"
        include_length = yes
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
        default_eap_type = "mschapv2"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
        soh = no
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
        with_ntdomain_hack = no
        send_error = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess
  preprocess {
        huntgroups = "/etc/raddb/huntgroups"
        hints = "/etc/raddb/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
reading pairlist file /etc/raddb/huntgroups
reading pairlist file /etc/raddb/hints
 Module: Linked to module rlm_realm
 Module: Instantiating module "suffix" from file /etc/raddb/modules/realm
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = no
  }
 Module: Linked to module rlm_files
 Module: Instantiating module "files" from file /etc/raddb/modules/files
  files {
        usersfile = "/etc/raddb/users"
        acctusersfile = "/etc/raddb/acct_users"
        preproxy_usersfile = "/etc/raddb/preproxy_users"
        compat = "no"
  }
reading pairlist file /etc/raddb/users
reading pairlist file /etc/raddb/acct_users
reading pairlist file /etc/raddb/preproxy_users
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique
  acct_unique {
        key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating module "detail" from file /etc/raddb/modules/detail
  detail {
        detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
        header = "%t"
        detailperm = 384
        dirperm = 493
        locking = no
        log_packet_header = no
  }
 Module: Linked to module rlm_attr_filter
 Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter
  attr_filter attr_filter.accounting_response {
        attrsfile = "/etc/raddb/attrs.accounting_response"
        key = "%{User-Name}"
        relaxed = no
  }
reading pairlist file /etc/raddb/attrs.accounting_response
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp
  radutmp {
        filename = "/var/log/radius/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        perm = 384
        callerid = yes
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter
  attr_filter attr_filter.access_reject {
        attrsfile = "/etc/raddb/attrs.access_reject"
        key = "%{User-Name}"
        relaxed = no
  }
reading pairlist file /etc/raddb/attrs.access_reject
 } # modules
} # server
server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Checking authorize {...} for more modules to load
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = *
        port = 1645
}
listen {
        type = "acct"
        ipaddr = *
        port = 1646
}
listen {
        type = "control"
 listen {
        socket = "/var/run/radiusd/radiusd.sock"
 }
}
listen {
        type = "auth"
        ipaddr = 127.0.0.1
        port = 18120
}
Listening on authentication address * port 1645
Listening on accounting address * port 1646
Listening on command file /var/run/radiusd/radiusd.sock
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1647
Ready to process requests.
rad_recv: Access-Request packet from host 10.226.x.x port 56055, id=207, length=195
        NAS-Identifier = "Juniper IVE"
        User-Name = "xxxxxxxxx@ssl-admin.bell"
        User-Password = "873901936144"
        Tunnel-Client-Endpoint:0 = "10.254.x.x"
        NAS-IP-Address = 10.226.x.x
        NAS-Port = 0
        Acct-Session-Id = "baxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)\"Mon Jul 16 12:55:07 2018\"+/SSGJd2"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] Looking up realm "ssl-admin.bell" for User-Name = "xxxxxxxxx@ssl-admin.bell"
[suffix] Found realm "ssl-admin.bell"
[suffix] Adding Stripped-User-Name = "xxxxxxxxx"
[suffix] Adding Realm = "ssl-admin.bell"
[suffix] Proxying request from user xxxxxxxxx to realm ssl-admin.bell
[suffix] Preparing to proxy authentication request to realm "ssl-admin.bell"
++[suffix] = updated
[eap] No EAP-Message, not doing EAP
++[eap] = noop
++[files] = noop
[ldap] performing user authorization for xxxxxxxxx
[ldap]  expand: (cn=%{User-Name}) -> (cn=xxxxxxxxx@ssl-admin.bell)
[ldap]  expand: dc=connexim,dc=com -> dc=connexim,dc=com
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] attempting LDAP reconnection
  [ldap] (re)connect to 10.234.x.x:389, authentication 0
  [ldap] bind as cn=Manager,dc=connexim,dc=com/laboratoire to 10.234.x.x:389
  [ldap] waiting for bind result ...
  [ldap] Bind was successful
  [ldap] performing search in dc=connexim,dc=com, with filter (cn=xxxxxxxxx@ssl-admin.bell)
[ldap] looking for check items in directory...
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.227.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x
  [ldap] radiusClientIPAddress -> NAS-IP-Address == 10.226.x.x
[ldap] looking for reply items in directory...
  [ldap] radiusClass -> Class = 0x61646d696e
WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly?
[ldap] Setting Auth-Type = LDAP
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] = ok
++[expiration] = noop
++[logintime] = noop
++[pap] = noop
+} # group authorize = updated
  WARNING: Empty pre-proxy section.  Using default return values.
Sending Access-Request of id 76 to 10.68.x.x port 1645
        NAS-Identifier = "Juniper IVE"
        User-Name = "xxxxxxxxx"
        User-Password = "873901936144"
        Tunnel-Client-Endpoint:0 = "10.254.x.x"
        NAS-IP-Address = 10.226.x.x
        NAS-Port = 0
        Acct-Session-Id = "xxxxxxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)\"Mon Jul 16 12:55:07 2018\"+/SSGJd2"
        Proxy-State = 0x323037
Proxying request 0 to home server 10.68.x.x port 1645
Sending Access-Request of id 76 to 10.68.x.x port 1645
        NAS-Identifier = "Juniper IVE"
        User-Name = "xxxxxxxxx"
        User-Password = "873901936144"
        Tunnel-Client-Endpoint:0 = "10.254.x.x"
        NAS-IP-Address = 10.226.x.x
        NAS-Port = 0
        Acct-Session-Id = "xxxxxxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)\"Mon Jul 16 12:55:07 2018\"+/SSGJd2"
        Proxy-State = 0x323037
Going to the next request
Waking up in 0.9 seconds.
Waking up in 13.0 seconds.
rad_recv: Access-Accept packet from host 10.68.x.x port 1645, id=76, length=83
        Class = 0x53425232434c9db383ebde9481cabcc01180250180038198ce8002800881b198a683b1c4eab312800e819db383ebde9481cabcc080cf9af0
        Proxy-State = 0x323037
# Executing section post-proxy from file /etc/raddb/sites-enabled/default
+group post-proxy {
[eap] No pre-existing handler found
++[eap] = noop
+} # group post-proxy = noop
Found Auth-Type = LDAP
Found Auth-Type = Accept
Warning:  Found 2 auth-types on request for user 'xxxxxxxxx'
Auth-Type = Accept, accepting the user
# Executing section post-auth from file /etc/raddb/sites-enabled/default
+group post-auth {
++[exec] = noop
+} # group post-auth = noop
Sending Access-Accept of id 207 to 10.226.x.x port 56055
        Class = 0x53425232434c9db383ebde9481cabcc01180250180038198ce8002800881b198a683b1c4eab312800e819db383ebde9481cabcc080cf9af0
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 207 with timestamp +98
Ready to process requests.

---------------------------------------------------------
Last thing: when the user tries to login on his device, he gets the following message in his device's logs:

2018-07-16 12:27:10 - ive - [10.254.x.x] baxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)[] - Login failed. Reason: No Roles
2018-07-16 12:27:10 - ive - [10.254.x.x] baxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)[] - Primary authentication successful for baxxxx@ssl-admin.bell/FreeRadius-Test-New from 10.254.x.x

A test with another user last Friday had the following logs on the device's logs:

2018/07/13 10:10:33 - [10.254.x.x] - baxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)[] - Variable userAttr@FreeRadius-Test-New.Class = "<Binary Data>"
2018/07/13 10:10:33 - [10.254.x.x] - baxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)[] - No match on rule 'userAttr.Class = 'ssl-oper''
2018/07/13 10:10:33 - [10.254.x.x] - baxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)[] - No match on rule 'userAttr.Class = 'admin''
2018/07/13 10:10:33 - [10.254.x.x] - baxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)[] - Realm Admin Users - FreeRadius-Test-New did not map user baxxxx@ssl-admin.bell to any roles
2018/07/13 10:10:33 - [10.254.99.171] - baxxxx@ssl-admin.bell(Admin Users - FreeRadius-Test-New)[] - Sign-in rejected. Reason: No Roles

Thanks,

Benoit Petit
Analyste Technique | Technical Analyst
Sécurité et Intelligence Digitale TI | IT Security and Digital Intelligence
1 Carrefour Alexandre-Graham-Bell - Aile E - 3e étage - Verdun - QC - H3E 3B3
514-391-9247
L'utilisation de ce message et régie par notre politique de courriel. www.bell.ca/PolitiqueConfidentialiteCourriel
The use of this message is restricted by our mail policies. www.bell.ca/EmailConfidentialityWarning

Freeradius and ldap attribute mismatch

Petit, Benoit