Hello, I have managed to get this working with TTLS & PEAP with EAP-MSCHAPV2 But I still get rejected ([mschap] FAILED: MS-CHAP2-Response is incorrect) when using TTLS with MSCHAPV2. That's is to say, when using EAP-MSCHAPV2 (CHAP messages are encapsulated inside the EAP message) - this works When using just MSCHAPV2 (CHAP messages are NOT encapsulated inside the EAP message) - This does not work. But, the same thing as before: If the username does not have a suffix (user instead of user@domain) both in the SQL database and on the supplicant, then it also works with just MSCHAPV2 (CHAP messages are NOT encapsulated inside the EAP message). As soon as I try to authenticate a user that has a suffix, they get rejected. Can anyone suggest something to try? Much appreciated. Thanks -----Original Message----- From: Dean Goldhill Sent: 09 June 2014 18:03 To: 'FreeRadius users mailing list' Subject: RE: MSCHAPV2 authenticate including the suffix Thank you Alan, This is now working with the same config after upgrading to version 2.2.5 -----Original Message----- From: freeradius-users-bounces+dgoldhill=netutils.com@lists.freeradius.org [mailto:freeradius-users-bounces+dgoldhill=netutils.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 09 June 2014 14:26 To: FreeRadius users mailing list Subject: Re: MSCHAPV2 authenticate including the suffix Dean Goldhill wrote:
When trying to authenticate, it says:
[mschap] ERROR: User-Name (user@domain.com) is not the same as MS-CHAP Name (user) from EAP-MSCHAPv2.
Use a recent version of the server. That error has been changed to a warning. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html