On Feb 5, 2016, at 6:23 PM, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:
I have some users, apparently always the same, who get rejected with this error message... I managed to get a session containing the failure captured in debug mode. Not sure if I should post more, but this the end of one such session....
How can I get to the root cause of their rejections?
Read the debug output.
(267) EXPAND {nt}%{1} (267) --> {nt}1DD9FC26BF0FCD74413AF390A74F559B (267) Password-With-Header := {nt}1DD9FC26BF0FCD74413AF390A74F559B
That's the first piece of information.
(267) eap_md5: Cleartext-Password is required for EAP-MD5 authentication
That's the second piece of information. You can't do EAP-MD5 with NT hashed passwords. For details, see: http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok.