2011/11/10 Phil Mayers <p.mayers@imperial.ac.uk>
Ok, your debug says:

rad_recv: Access-Request packet from host 172.20.40.11 port 1025, id=21, length=218
       Framed-MTU = 1480
       NAS-IP-Address = 172.20.40.11
       NAS-Identifier = "SW-Priv-1-1"

       User-Name = "OPTARE\\brouco"
<snip>
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok

Why is preprocess returning "ok".
this is preprocess
preprocess {
        huntgroups = ${confdir}/huntgroups
        hints = ${confdir}/hints

        # This hack changes Ascend's wierd port numberings
        # to standard 0-??? port numbers so that the "+" works
        # for IP address assignments.
        with_ascend_hack = no
        ascend_channels_per_line = 23

        # Windows NT machines often authenticate themselves as
        # NT_DOMAIN\username
        #
        # If this is set to 'yes', then the NT_DOMAIN portion
        # of the user-name is silently discarded.
        #
        # This configuration entry SHOULD NOT be used.
        # See the "realms" module for a better way to handle
        # NT domains.
        with_ntdomain_hack = yes

        # Specialix Jetstream 8500 24 port access server.
        #
        # If the user name is 10 characters or longer, a "/"
        # and the excess characters after the 10th are
        # appended to the user name.
        #
        # If you're not running that NAS, you don't need
        # this hack.
        with_specialix_jetstream_hack = no

        # Cisco (and Quintum in Cisco mode) sends it's VSA attributes
        # with the attribute name *again* in the string, like:
        #
        #   H323-Attribute = "h323-attribute=value".
        #
        # If this configuration item is set to 'yes', then
        # the redundant data in the the attribute text is stripped
        # out.  The result is:
        #
        #  H323-Attribute = "value"
        #
        # If you're not running a Cisco or Quintum NAS, you don't
                                                                                         
 }

What are you doing in the hints module?

Are you modifying the username field? A few lines later it says:

[ldap]  expand: %{User-Name} -> brouco


If you're modifying the username, you can't do that. It will break EAP, which is why it says:

[eap] Identity does not match User-Name, setting from EAP Identity.

...then fails.

I assume you want to strip "DOMAIN\" so that you can do LDAP? You CANNOT modify the User-Name field. You MUST used the Stripped-User-Name field, and leave the User-Name field alone.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html