Hi Phil, I got the point and it works! Thank you! BTW, any idea why this failes?
DOMAIN\username -> username
The command: radtest -t mschap VERWALTUNG\gougousoudis testpwd 127.0.0.1:1812 0 testing123 gives this output. It seems, that the "\" doesn't come through (i use bash-shell). Even escaping with \\ didn't work. rad_recv: Access-Request packet from host 127.0.0.1 port 49087, id=21, length=130 User-Name = "VERWALTUNGgougousoudis" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 MS-CHAP-Challenge = 0x9c8b269ebf5831c3 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000231e6b56bbfa62485bd1e5658b1843758a4b35af52fabc16 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "VERWALTUNGgougousoudis", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "VERWALTUNGgougousoudis", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for VERWALTUNGgougousoudis [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{mschap:User-Name} -> VERWALTUNGgougousoudis [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{mschap:User-Name}}) -> (uid=VERWALTUNGgougousoudis) [ldap] expand: dc=verwaltung,dc=kh-berlin,dc=de -> dc=verwaltung,dc=kh-berlin,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=verwaltung,dc=kh-berlin,dc=de, with filter (uid=VERWALTUNGgougousoudis) [ldap] object not found Thanks Alex