Ok, Either I'm very stupid, or something is not working :( Debug output: rlm_sql (sql): Released sql socket id: 8 rlm_sql (sql): No matching entry in the database for request from user [user@domain.com] modcall[authorize]: module "sql" returns notfound for request 6 modcall: leaving group authorize (returns ok) for request 6 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [user@domain.com/password] (from client ACS01 port 17 cli 00:01:4A:5E:86:80) However, My authorize_check_query returns: +--------------------------------------+-------------------------------------------------+-----------+------------+----+ | EntryID | CONCAT(`User`.Username, '@', `Realm`.RealmName) | Attribute | Value | op | +--------------------------------------+-------------------------------------------------+-----------+------------+----+ | 6c9b56e2-833b-1029-8ba8-00005e000164 | user@domain.com | Password | password | == | +--------------------------------------+-------------------------------------------------+-----------+------------+----+ My authorize_reply_query returns: blank. Dont use return items on a per user level My authorize_group_check_query: +--------------------------------------+------------------+------------------+-------------+----+ | EntryID | GroupName | Attribute | Value | op | +--------------------------------------+------------------+------------------+-------------+----+ | 7277e77a-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Auth-Type | Local | = | | 7276ec35-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Framed-Protocol | PPP | == | | 7278f993-8331-1029-8ba8-00005e000164 | PPPoE Test Group | NAS-Port-Type | Ethernet | == | | 727b0157-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Pool-Name | IP-WLAN | := | | 727a0eba-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Service-Type | Framed-User | == | | 7275f803-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Simultaneous-Use | 1 | := | +--------------------------------------+------------------+------------------+-------------+----+ And, the authorize_reply_query +--------------------------------------+------------------+-------------------------+-----------------------------------+----+ | EntryID | GroupName | Attribute | Value | op | +--------------------------------------+------------------+-------------------------+-----------------------------------+----+ | e5a85344-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Acct-Interim-Interval | 3600 | := | | e5a26d7c-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Class | WLAN | := | | e5a37a9b-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Framed-Netmask | 255.255.255.255 | := | | e5a4d134-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Framed-Protocol | PPP | := | | e5a60591-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Framed-Routing | Broadcast-Listen | := | | e5a74936-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Mikrotik-Rate-Limit | 64k/1024k 64k/1024k 64k/1024k 15s | := | | e5a97448-8331-1029-8ba8-00005e000164 | PPPoE Test Group | MS-Primary-DNS-Server | 198.18.0.36 | := | | e5aa9732-8331-1029-8ba8-00005e000164 | PPPoE Test Group | MS-Secondary-DNS-Server | 198.18.0.4 | := | | e5ab9178-8331-1029-8ba8-00005e000164 | PPPoE Test Group | Service-Type | Framed-User | := | +--------------------------------------+------------------+-------------------------+-----------------------------------+----+ What exactly is it not finding??? :( Regards, Chris.