I have a problem with the authorization by LDAP and Authentication with AD

31 Jul 2017

      Hello,

the Server ist CentOS7.3 with Radius 3.0.15.
The AD Server is a Windows 2012 R2.

The Radius server is integrated into the Active Directory domain.
I would like that only certain users connect to the AD domain.
When I connect to the radius server via eapol_test, the authorization
by LDAP as well as the AD authentication by AD perfectly.
If I want to log on to the AD domain from a Windows 10 client with the
same user account, this does not work.
C5c5 is prepended to the username.
A realm with the domain name and the content skip was created in the
proxy.conf, as well as the ntdomain entry in the sites-enabeld /
default, but the user name still contains C5C5.
Here I add the debug content.

-----
FreeRADIUS Version 3.0.15
Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/raddb/dictionary
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/mods-enabled/
including configuration file /etc/raddb/mods-enabled/always
including configuration file /etc/raddb/mods-enabled/attr_filter
including configuration file /etc/raddb/mods-enabled/cache_eap
including configuration file /etc/raddb/mods-enabled/chap
including configuration file /etc/raddb/mods-enabled/date
including configuration file /etc/raddb/mods-enabled/detail
including configuration file /etc/raddb/mods-enabled/detail.log
including configuration file /etc/raddb/mods-enabled/dhcp
including configuration file /etc/raddb/mods-enabled/digest
including configuration file /etc/raddb/mods-enabled/dynamic_clients
including configuration file /etc/raddb/mods-enabled/eap
including configuration file /etc/raddb/mods-enabled/echo
including configuration file /etc/raddb/mods-enabled/exec
including configuration file /etc/raddb/mods-enabled/expiration
including configuration file /etc/raddb/mods-enabled/expr
including configuration file /etc/raddb/mods-enabled/files
including configuration file /etc/raddb/mods-enabled/linelog
including configuration file /etc/raddb/mods-enabled/logintime
including configuration file /etc/raddb/mods-enabled/mschap
including configuration file /etc/raddb/mods-enabled/ntlm_auth
including configuration file /etc/raddb/mods-enabled/pap
including configuration file /etc/raddb/mods-enabled/passwd
including configuration file /etc/raddb/mods-enabled/preprocess
including configuration file /etc/raddb/mods-enabled/radutmp
including configuration file /etc/raddb/mods-enabled/realm
including configuration file /etc/raddb/mods-enabled/replicate
including configuration file /etc/raddb/mods-enabled/soh
including configuration file /etc/raddb/mods-enabled/sradutmp
including configuration file /etc/raddb/mods-enabled/unix
including configuration file /etc/raddb/mods-enabled/unpack
including configuration file /etc/raddb/mods-enabled/utf8
including configuration file /etc/raddb/mods-enabled/ldap
including files in directory /etc/raddb/policy.d/
including configuration file /etc/raddb/policy.d/abfab-tr
including configuration file /etc/raddb/policy.d/accounting
including configuration file /etc/raddb/policy.d/canonicalization
including configuration file /etc/raddb/policy.d/control
including configuration file /etc/raddb/policy.d/cui
including configuration file /etc/raddb/policy.d/debug
including configuration file /etc/raddb/policy.d/dhcp
including configuration file /etc/raddb/policy.d/eap
including configuration file /etc/raddb/policy.d/filter
including configuration file /etc/raddb/policy.d/moonshot-targeted-ids
including configuration file /etc/raddb/policy.d/operator-name
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/default
including configuration file /etc/raddb/sites-enabled/inner-tunnel
main {
 security {
  allow_core_dumps = no
 }
name = "radiusd"
prefix = "/usr"
localstatedir = "/var"
logdir = "/var/log/radius"
run_dir = "/var/run/radiusd"
}
main {
name = "radiusd"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/radius"
run_dir = "/var/run/radiusd"
libdir = "/usr/lib64/freeradius"
radacctdir = "/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 16384
pidfile = "/var/run/radiusd/radiusd.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
 log {
  stripped_names = no
  auth = no
  auth_badpass = no
  auth_goodpass = no
  colourise = yes
  msg_denied = "You are already logged in - access denied"
 }
 resources {
 }
 security {
  max_attributes = 200
  reject_delay = 1.000000
  status_server = yes
  allow_vulnerable_openssl = "yes"
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
  retry_delay = 5
  retry_count = 3
  default_fallback = no
  dead_time = 120
  wake_all_if_all_dead = no
 }
 home_server localhost {
  ipaddr = 127.0.0.1
  port = 1812
  type = "auth"
  secret = <<< secret >>>
  response_window = 20.000000
  response_timeouts = 1
  max_outstanding = 65536
  zombie_period = 40
  status_check = "status-server"
  ping_interval = 30
  check_interval = 30
  check_timeout = 4
  num_answers_to_alive = 3
  revive_interval = 120
  limit {
  max_connections = 16
  max_requests = 0
  lifetime = 0
  idle_timeout = 0
  }
  coa {
  irt = 2
  mrt = 16
  mrc = 5
  mrd = 30
  }
 }
 realm SEDLMEIER {
 }
 home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
 }
 realm example.com {
auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
radiusd: #### Loading Clients ####
 client localhost {
  ipaddr = 127.0.0.1
  require_message_authenticator = no
  secret = <<< secret >>>
  nas_type = "other"
  proto = "*"
  limit {
  max_connections = 16
  lifetime = 0
  idle_timeout = 30
  }
 }
 client localhost_ipv6 {
  ipv6addr = ::1
  require_message_authenticator = no
  secret = <<< secret >>>
  limit {
  max_connections = 16
  lifetime = 0
  idle_timeout = 30
  }
 }
 client 192.168.99.2 {
  ipaddr = 192.168.99.2
  require_message_authenticator = no
  secret = <<< secret >>>
  shortname = "A4H124-24"
  nas_type = "other"
  limit {
  max_connections = 16
  lifetime = 0
  idle_timeout = 30
  }
 }
Debugger not attached
systemd watchdog is disabled.
 # Creating Auth-Type = ntlm_auth
 # Creating Auth-Type = mschap
 # Creating Auth-Type = digest
 # Creating Auth-Type = eap
 # Creating Auth-Type = PAP
 # Creating Auth-Type = CHAP
 # Creating Auth-Type = MS-CHAP
radiusd: #### Instantiating modules ####
 modules {
  # Loaded module rlm_always
  # Loading module "reject" from file /etc/raddb/mods-enabled/always
  always reject {
  rcode = "reject"
  simulcount = 0
  mpp = no
  }
  # Loading module "fail" from file /etc/raddb/mods-enabled/always
  always fail {
  rcode = "fail"
  simulcount = 0
  mpp = no
  }
  # Loading module "ok" from file /etc/raddb/mods-enabled/always
  always ok {
  rcode = "ok"
  simulcount = 0
  mpp = no
  }
  # Loading module "handled" from file /etc/raddb/mods-enabled/always
  always handled {
  rcode = "handled"
  simulcount = 0
  mpp = no
  }
  # Loading module "invalid" from file /etc/raddb/mods-enabled/always
  always invalid {
  rcode = "invalid"
  simulcount = 0
  mpp = no
  }
  # Loading module "userlock" from file /etc/raddb/mods-enabled/always
  always userlock {
  rcode = "userlock"
  simulcount = 0
  mpp = no
  }
  # Loading module "notfound" from file /etc/raddb/mods-enabled/always
  always notfound {
  rcode = "notfound"
  simulcount = 0
  mpp = no
  }
  # Loading module "noop" from file /etc/raddb/mods-enabled/always
  always noop {
  rcode = "noop"
  simulcount = 0
  mpp = no
  }
  # Loading module "updated" from file /etc/raddb/mods-enabled/always
  always updated {
  rcode = "updated"
  simulcount = 0
  mpp = no
  }
  # Loaded module rlm_attr_filter
  # Loading module "attr_filter.post-proxy" from file
/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.post-proxy {
  filename = "/etc/raddb/mods-config/attr_filter/post-proxy"
  key = "%{Realm}"
  relaxed = no
  }
  # Loading module "attr_filter.pre-proxy" from file
/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.pre-proxy {
  filename = "/etc/raddb/mods-config/attr_filter/pre-proxy"
  key = "%{Realm}"
  relaxed = no
  }
  # Loading module "attr_filter.access_reject" from file
/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.access_reject {
  filename = "/etc/raddb/mods-config/attr_filter/access_reject"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loading module "attr_filter.access_challenge" from file
/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.access_challenge {
  filename = "/etc/raddb/mods-config/attr_filter/access_challenge"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loading module "attr_filter.accounting_response" from file
/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.accounting_response {
  filename = "/etc/raddb/mods-config/attr_filter/accounting_response"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loaded module rlm_cache
  # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap
  cache cache_eap {
  driver = "rlm_cache_rbtree"
  key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
  ttl = 15
  max_entries = 0
  epoch = 0
  add_stats = no
  }
  # Loaded module rlm_chap
  # Loading module "chap" from file /etc/raddb/mods-enabled/chap
  # Loaded module rlm_date
  # Loading module "date" from file /etc/raddb/mods-enabled/date
  date {
  format = "%b %e %Y %H:%M:%S %Z"
  utc = no
  }
  # Loaded module rlm_detail
  # Loading module "detail" from file /etc/raddb/mods-enabled/detail
  detail {
  filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log
  detail auth_log {
  filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log
  detail reply_log {
  filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log
  detail pre_proxy_log {
  filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log
  detail post_proxy_log {
  filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loaded module rlm_dhcp
  # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp
  # Loaded module rlm_digest
  # Loading module "digest" from file /etc/raddb/mods-enabled/digest
  # Loaded module rlm_dynamic_clients
  # Loading module "dynamic_clients" from file
/etc/raddb/mods-enabled/dynamic_clients
  # Loaded module rlm_eap
  # Loading module "eap" from file /etc/raddb/mods-enabled/eap
  eap {
  default_eap_type = "peap"
  timer_expire = 60
  ignore_unknown_eap_types = no
  cisco_accounting_username_bug = no
  max_sessions = 16384
  }
  # Loaded module rlm_exec
  # Loading module "echo" from file /etc/raddb/mods-enabled/echo
  exec echo {
  wait = yes
  program = "/bin/echo %{User-Name}"
  input_pairs = "request"
  output_pairs = "reply"
  shell_escape = yes
  }
  # Loading module "exec" from file /etc/raddb/mods-enabled/exec
  exec {
  wait = no
  input_pairs = "request"
  shell_escape = yes
  timeout = 10
  }
  # Loaded module rlm_expiration
  # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration
  # Loaded module rlm_expr
  # Loading module "expr" from file /etc/raddb/mods-enabled/expr
  expr {
  safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  }
  # Loaded module rlm_files
  # Loading module "files" from file /etc/raddb/mods-enabled/files
  files {
  filename = "/etc/raddb/mods-config/files/authorize"
  acctusersfile = "/etc/raddb/mods-config/files/accounting"
  preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy"
  }
  # Loaded module rlm_linelog
  # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog
  linelog {
  filename = "/var/log/radius/linelog"
  escape_filenames = no
  syslog_severity = "info"
  permissions = 384
  format = "This is a log message for %{User-Name}"
  reference = "messages.%{%{reply:Packet-Type}:-default}"
  }
  # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog
  linelog log_accounting {
  filename = "/var/log/radius/linelog-accounting"
  escape_filenames = no
  syslog_severity = "info"
  permissions = 384
  format = ""
  reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
  }
  # Loaded module rlm_logintime
  # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime
  logintime {
  minimum_timeout = 60
  }
  # Loaded module rlm_mschap
  # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap
  mschap {
  use_mppe = yes
  require_encryption = yes
  require_strong = yes
  with_ntdomain_hack = yes
  ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name:-None}
--domain=%{%{mschap:NT-Domain}:-SEDLMEIER}
--challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"
   passchange {
   }
  allow_retry = yes
  winbind_retry_with_normalised_username = no
  }
  # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth
  exec ntlm_auth {
  wait = yes
  program = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name} --domain=SEDLMEIER
--password=%{User-Password}"
  shell_escape = yes
  }
  # Loaded module rlm_pap
  # Loading module "pap" from file /etc/raddb/mods-enabled/pap
  pap {
  normalise = yes
  }
  # Loaded module rlm_passwd
  # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd
  passwd etc_passwd {
  filename = "/etc/passwd"
  format = "*User-Name:Crypt-Password:"
  delimiter = ":"
  ignore_nislike = no
  ignore_empty = yes
  allow_multiple_keys = no
  hash_size = 100
  }
  # Loaded module rlm_preprocess
  # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess
  preprocess {
  huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups"
  hints = "/etc/raddb/mods-config/preprocess/hints"
  with_ascend_hack = no
  ascend_channels_per_line = 23
  with_ntdomain_hack = no
  with_specialix_jetstream_hack = no
  with_cisco_vsa_hack = no
  with_alvarion_vsa_hack = no
  }
  # Loaded module rlm_radutmp
  # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp
  radutmp {
  filename = "/var/log/radius/radutmp"
  username = "%{User-Name}"
  case_sensitive = yes
  check_with_nas = yes
  permissions = 384
  caller_id = yes
  }
  # Loaded module rlm_realm
  # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm
  realm IPASS {
  format = "prefix"
  delimiter = "/"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "suffix" from file /etc/raddb/mods-enabled/realm
  realm suffix {
  format = "suffix"
  delimiter = "@"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm
  realm realmpercent {
  format = "suffix"
  delimiter = "%"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm
  realm ntdomain {
  format = "prefix"
  delimiter = "\\"
  ignore_default = no
  ignore_null = no
  }
  # Loaded module rlm_replicate
  # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate
  # Loaded module rlm_soh
  # Loading module "soh" from file /etc/raddb/mods-enabled/soh
  soh {
  dhcp = yes
  }
  # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp
  radutmp sradutmp {
  filename = "/var/log/radius/sradutmp"
  username = "%{User-Name}"
  case_sensitive = yes
  check_with_nas = yes
  permissions = 420
  caller_id = no
  }
  # Loaded module rlm_unix
  # Loading module "unix" from file /etc/raddb/mods-enabled/unix
  unix {
  radwtmp = "/var/log/radius/radwtmp"
  }
Creating attribute Unix-Group
  # Loaded module rlm_unpack
  # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack
  # Loaded module rlm_utf8
  # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8
  # Loaded module rlm_ldap
  # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap
  ldap {
  server = "sed-vm-dc-01.sedlmeier.local"
  identity = "CN=Anonymous,CN=Users,DC=sedlmeier,DC=local"
  password = <<< secret >>>
   sasl {
   }
   user {
    scope = "sub"
    access_positive = yes
    sasl {
    }
   }
   group {
    filter = "(objectClass=posixGroup)"
    scope = "sub"
    name_attribute = "cn"
    membership_attribute = "memberOf"
    cacheable_name = no
    cacheable_dn = no
   }
   client {
    filter = "(objectClass=radiusClient)"
    scope = "sub"
    base_dn = "OU=Mitarbeiter,DC=sedlmeier,DC=local"
   }
   profile {
   }
   options {
    ldap_debug = 40
    chase_referrals = yes
    rebind = yes
    net_timeout = 1
    res_timeout = 10
    srv_timelimit = 3
    idle = 60
    probes = 3
    interval = 3
   }
   tls {
    start_tls = no
   }
  }
Creating attribute LDAP-Group
  instantiate {
  }
  # Instantiating module "reject" from file /etc/raddb/mods-enabled/always
  # Instantiating module "fail" from file /etc/raddb/mods-enabled/always
  # Instantiating module "ok" from file /etc/raddb/mods-enabled/always
  # Instantiating module "handled" from file /etc/raddb/mods-enabled/always
  # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always
  # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always
  # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always
  # Instantiating module "noop" from file /etc/raddb/mods-enabled/always
  # Instantiating module "updated" from file /etc/raddb/mods-enabled/always
  # Instantiating module "attr_filter.post-proxy" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy
  # Instantiating module "attr_filter.pre-proxy" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy
  # Instantiating module "attr_filter.access_reject" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject
[/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item
"FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT".
[/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item
"FreeRADIUS-Response-Delay-USec" found in filter list for realm
"DEFAULT".
  # Instantiating module "attr_filter.access_challenge" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge
  # Instantiating module "attr_filter.accounting_response" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response
  # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module
rlm_cache_rbtree) loaded and linked
  # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail
  # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
detail output
  # Instantiating module "reply_log" from file
/etc/raddb/mods-enabled/detail.log
  # Instantiating module "pre_proxy_log" from file
/etc/raddb/mods-enabled/detail.log
  # Instantiating module "post_proxy_log" from file
/etc/raddb/mods-enabled/detail.log
  # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap
   # Linked to sub-module rlm_eap_md5
   # Linked to sub-module rlm_eap_leap
   # Linked to sub-module rlm_eap_gtc
   gtc {
    challenge = "Password: "
    auth_type = "PAP"
   }
   # Linked to sub-module rlm_eap_tls
   tls {
    tls = "tls-common"
   }
   tls-config tls-common {
    verify_depth = 0
    ca_path = "/etc/raddb/certs"
    pem_file_type = yes
    private_key_file = "/etc/raddb/certs/server.pem"
    certificate_file = "/etc/raddb/certs/server.pem"
    ca_file = "/etc/raddb/certs/ca.pem"
    private_key_password = <<< secret >>>
    dh_file = "/etc/raddb/certs/dh"
    fragment_size = 1024
    include_length = yes
    auto_chain = yes
    check_crl = no
    check_all_crl = no
    cipher_list = "DEFAULT"
    cipher_server_preference = no
    ecdh_curve = "prime256v1"
    cache {
    enable = no
    lifetime = 24
    max_entries = 255
    }
    verify {
    skip_if_ocsp_ok = no
    }
    ocsp {
    enable = no
    override_cert_url = yes
    url = "http://127.0.0.1/ocsp/"
    use_nonce = yes
    timeout = 0
    softfail = no
    }
   }
   # Linked to sub-module rlm_eap_ttls
   ttls {
    tls = "tls-common"
    default_eap_type = "md5"
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    virtual_server = "inner-tunnel"
    include_length = yes
    require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_peap
   peap {
    tls = "tls-common"
    default_eap_type = "mschapv2"
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    proxy_tunneled_request_as_eap = yes
    virtual_server = "inner-tunnel"
    soh = no
    require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_mschapv2
   mschapv2 {
    with_ntdomain_hack = no
    send_error = no
   }
  # Instantiating module "expiration" from file
/etc/raddb/mods-enabled/expiration
  # Instantiating module "files" from file /etc/raddb/mods-enabled/files
reading pairlist file /etc/raddb/mods-config/files/authorize
reading pairlist file /etc/raddb/mods-config/files/accounting
reading pairlist file /etc/raddb/mods-config/files/pre-proxy
  # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog
  # Instantiating module "log_accounting" from file
/etc/raddb/mods-enabled/linelog
  # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime
  # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
  # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap
  # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  # Instantiating module "preprocess" from file
/etc/raddb/mods-enabled/preprocess
reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups
reading pairlist file /etc/raddb/mods-config/preprocess/hints
  # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm
  # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm
  # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm
  # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm
  # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap
rlm_ldap: libldap vendor: OpenLDAP, version: 20440
   accounting {
    reference = "%{tolower:type.%{Acct-Status-Type}}"
   }
   post-auth {
    reference = "."
   }
rlm_ldap (ldap): Initialising connection pool
   pool {
    start = 5
    min = 3
    max = 32
    spare = 10
    uses = 0
    lifetime = 0
    cleanup_interval = 30
    idle_timeout = 60
    retry_delay = 30
    spread = no
   }
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
 } # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/raddb/radiusd.conf
} # server
server default { # from file /etc/raddb/sites-enabled/default
 # Loading authenticate {...}
 # Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
 # Loading preacct {...}
 # Loading accounting {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
} # server default
server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel
 # Loading authenticate {...}
 # Loading authorize {...}
 # Loading session {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
 # Skipping contents of 'if' as it is always 'false' --
/etc/raddb/sites-enabled/inner-tunnel:333
} # server inner-tunnel
radiusd: #### Opening IP addresses and Ports ####
listen {
  type = "auth"
  ipaddr = *
  port = 0
   limit {
    max_connections = 16
    lifetime = 0
    idle_timeout = 30
   }
}
listen {
  type = "acct"
  ipaddr = *
  port = 0
   limit {
    max_connections = 16
    lifetime = 0
    idle_timeout = 30
   }
}
listen {
  type = "auth"
  ipv6addr = ::
  port = 0
   limit {
    max_connections = 16
    lifetime = 0
    idle_timeout = 30
   }
}
listen {
  type = "acct"
  ipv6addr = ::
  port = 0
   limit {
    max_connections = 16
    lifetime = 0
    idle_timeout = 30
   }
}
listen {
  type = "auth"
  ipaddr = 127.0.0.1
  port = 18120
}
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on proxy address * port 33834
Listening on proxy address :: port 42671
Ready to process requests
(0) Received Access-Request Id 73 from 192.168.99.2:56759 to
192.168.99.13:1812 length 217
(0)   User-Name = "host/rob-nb-3302.sedlmeier.local"
(0)   Service-Type = Framed-User
(0)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(0)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(0)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(0)   NAS-Port = 5
(0)   NAS-Port-Id = "fe.1.5"
(0)   Framed-MTU = 1500
(0)   NAS-Port-Type = Ethernet
(0)   EAP-Message =
0x0201002501686f73742f726f622d6e622d333330322e7365646c6d656965722e6c6f63616c
(0)   NAS-IP-Address = 0.0.0.0
(0)   Message-Authenticator = 0x1fb3f6d070bfcc1f115c0c3ef7304279
(0) # Executing section authorize from file /etc/raddb/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(0) suffix: No such realm "NULL"
(0)     [suffix] = noop
(0) ntdomain: Checking for prefix before "\"
(0) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(0) ntdomain: No such realm "NULL"
(0)     [ntdomain] = noop
(0) eap: Peer sent EAP Response (code 2) ID 1 length 37
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0)   authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_peap to process data
(0) eap_peap: Initiating new EAP-TLS session
(0) eap_peap: [eaptls start] = request
(0) eap: Sending EAP Request (code 1) ID 2 length 6
(0) eap: EAP session adding &reply:State = 0xe102a8b5e100b184
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0)   Challenge { ... } # empty sub-section is ignored
(0) Sent Access-Challenge Id 73 from 192.168.99.13:1812 to
192.168.99.2:56759 length 0
(0)   EAP-Message = 0x010200061920
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0xe102a8b5e100b184d77738e9a0e9bb1d
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 74 from 192.168.99.2:56759 to
192.168.99.13:1812 length 368
(1)   User-Name = "host/rob-nb-3302.sedlmeier.local"
(1)   Service-Type = Framed-User
(1)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(1)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(1)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(1)   NAS-Port = 5
(1)   NAS-Port-Id = "fe.1.5"
(1)   Framed-MTU = 1500
(1)   NAS-Port-Type = Ethernet
(1)   State = 0xe102a8b5e100b184d77738e9a0e9bb1d
(1)   EAP-Message =
0x020200aa1980000000a0160303009b010000970303597ef38f86bc72036aa032d81d72191d9453345ae162c46870df53732eea4aa100002ec02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a0005000401000040000500050100000000000a0008
(1)   NAS-IP-Address = 0.0.0.0
(1)   Message-Authenticator = 0x38b419601ddc1180666d1ddd50c69009
(1) session-state: No cached attributes
(1) # Executing section authorize from file /etc/raddb/sites-enabled/default
(1)   authorize {
(1)     policy filter_username {
(1)       if (&User-Name) {
(1)       if (&User-Name)  -> TRUE
(1)       if (&User-Name)  {
(1)         if (&User-Name =~ / /) {
(1)         if (&User-Name =~ / /)  -> FALSE
(1)         if (&User-Name =~ /@[^@]*@/ ) {
(1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(1)         if (&User-Name =~ /\.\./ ) {
(1)         if (&User-Name =~ /\.\./ )  -> FALSE
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(1)         if (&User-Name =~ /\.$/)  {
(1)         if (&User-Name =~ /\.$/)   -> FALSE
(1)         if (&User-Name =~ /@\./)  {
(1)         if (&User-Name =~ /@\./)   -> FALSE
(1)       } # if (&User-Name)  = notfound
(1)     } # policy filter_username = notfound
(1)     [preprocess] = ok
(1)     [chap] = noop
(1)     [mschap] = noop
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(1) suffix: No such realm "NULL"
(1)     [suffix] = noop
(1) ntdomain: Checking for prefix before "\"
(1) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(1) ntdomain: No such realm "NULL"
(1)     [ntdomain] = noop
(1) eap: Peer sent EAP Response (code 2) ID 2 length 170
(1) eap: Continuing tunnel setup
(1)     [eap] = ok
(1)   } # authorize = ok
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1)   authenticate {
(1) eap: Expiring EAP session with state 0xe102a8b5e100b184
(1) eap: Finished EAP session with state 0xe102a8b5e100b184
(1) eap: Previous EAP request found for state 0xe102a8b5e100b184,
released from the list
(1) eap: Peer sent packet with method EAP PEAP (25)
(1) eap: Calling submodule eap_peap to process data
(1) eap_peap: Continuing EAP-TLS
(1) eap_peap: Peer indicated complete TLS record size will be 160 bytes
(1) eap_peap: Got complete TLS record (160 bytes)
(1) eap_peap: [eaptls verify] = length included
(1) eap_peap: (other): before/accept initialization
(1) eap_peap: TLS_accept: before/accept initialization
(1) eap_peap: <<< recv TLS 1.2  [length 009b]
(1) eap_peap: TLS_accept: SSLv3 read client hello A
(1) eap_peap: >>> send TLS 1.2  [length 0039]
(1) eap_peap: TLS_accept: SSLv3 write server hello A
(1) eap_peap: >>> send TLS 1.2  [length 0910]
(1) eap_peap: TLS_accept: SSLv3 write certificate A
(1) eap_peap: >>> send TLS 1.2  [length 014d]
(1) eap_peap: TLS_accept: SSLv3 write key exchange A
(1) eap_peap: >>> send TLS 1.2  [length 0004]
(1) eap_peap: TLS_accept: SSLv3 write server done A
(1) eap_peap: TLS_accept: SSLv3 flush data
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(1) eap_peap: In SSL Handshake Phase
(1) eap_peap: In SSL Accept mode
(1) eap_peap: [eaptls process] = handled
(1) eap: Sending EAP Request (code 1) ID 3 length 1004
(1) eap: EAP session adding &reply:State = 0xe102a8b5e001b184
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1)   Challenge { ... } # empty sub-section is ignored
(1) Sent Access-Challenge Id 74 from 192.168.99.13:1812 to
192.168.99.2:56759 length 0
(1)   EAP-Message =
0x010303ec19c000000aae1603030039020000350303597ef38e2e75a527234143cba2f29969447b46ffca5b869584f926f6ee23572200c03000000dff01000100000b00040300010216030309100b00090c0009090003f7308203f3308202dba003020102020101300d06092a864886f70d01010b050030
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0xe102a8b5e001b184d77738e9a0e9bb1d
(1) Finished request
Waking up in 3.9 seconds.
(2) Received Access-Request Id 75 from 192.168.99.2:56759 to
192.168.99.13:1812 length 204
(2)   User-Name = "host/rob-nb-3302.sedlmeier.local"
(2)   Service-Type = Framed-User
(2)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(2)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(2)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(2)   NAS-Port = 5
(2)   NAS-Port-Id = "fe.1.5"
(2)   Framed-MTU = 1500
(2)   NAS-Port-Type = Ethernet
(2)   State = 0xe102a8b5e001b184d77738e9a0e9bb1d
(2)   EAP-Message = 0x020300061900
(2)   NAS-IP-Address = 0.0.0.0
(2)   Message-Authenticator = 0xefc96dba675de7807963c0dfd3423d12
(2) session-state: No cached attributes
(2) # Executing section authorize from file /etc/raddb/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /\.\./ ) {
(2)         if (&User-Name =~ /\.\./ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(2)         if (&User-Name =~ /\.$/)  {
(2)         if (&User-Name =~ /\.$/)   -> FALSE
(2)         if (&User-Name =~ /@\./)  {
(2)         if (&User-Name =~ /@\./)   -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(2) suffix: No such realm "NULL"
(2)     [suffix] = noop
(2) ntdomain: Checking for prefix before "\"
(2) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(2) ntdomain: No such realm "NULL"
(2)     [ntdomain] = noop
(2) eap: Peer sent EAP Response (code 2) ID 3 length 6
(2) eap: Continuing tunnel setup
(2)     [eap] = ok
(2)   } # authorize = ok
(2) Found Auth-Type = eap
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2)   authenticate {
(2) eap: Expiring EAP session with state 0xe102a8b5e001b184
(2) eap: Finished EAP session with state 0xe102a8b5e001b184
(2) eap: Previous EAP request found for state 0xe102a8b5e001b184,
released from the list
(2) eap: Peer sent packet with method EAP PEAP (25)
(2) eap: Calling submodule eap_peap to process data
(2) eap_peap: Continuing EAP-TLS
(2) eap_peap: Peer ACKed our handshake fragment
(2) eap_peap: [eaptls verify] = request
(2) eap_peap: [eaptls process] = handled
(2) eap: Sending EAP Request (code 1) ID 4 length 1000
(2) eap: EAP session adding &reply:State = 0xe102a8b5e306b184
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2)   Challenge { ... } # empty sub-section is ignored
(2) Sent Access-Challenge Id 75 from 192.168.99.13:1812 to
192.168.99.2:56759 length 0
(2)   EAP-Message =
0x010403e8194022518c1dec2cbb2f69d25320c61e68c7f0b7c8b0ae456881bf11f25fb4734527d9e23825158b087c6fd71853cbc94218fa747fbb854f8a6b48583f69cffde05d5cd8c71c2eab8f1cbfd016db9ee4fbfda2bba6b46ea1587e1118771bad825657998f00050c30820508308203f0a0030201
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0xe102a8b5e306b184d77738e9a0e9bb1d
(2) Finished request
Waking up in 3.9 seconds.
(3) Received Access-Request Id 76 from 192.168.99.2:56759 to
192.168.99.13:1812 length 204
(3)   User-Name = "host/rob-nb-3302.sedlmeier.local"
(3)   Service-Type = Framed-User
(3)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(3)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(3)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(3)   NAS-Port = 5
(3)   NAS-Port-Id = "fe.1.5"
(3)   Framed-MTU = 1500
(3)   NAS-Port-Type = Ethernet
(3)   State = 0xe102a8b5e306b184d77738e9a0e9bb1d
(3)   EAP-Message = 0x020400061900
(3)   NAS-IP-Address = 0.0.0.0
(3)   Message-Authenticator = 0xc72bebe3d29dc863209b5cd48ee982c0
(3) session-state: No cached attributes
(3) # Executing section authorize from file /etc/raddb/sites-enabled/default
(3)   authorize {
(3)     policy filter_username {
(3)       if (&User-Name) {
(3)       if (&User-Name)  -> TRUE
(3)       if (&User-Name)  {
(3)         if (&User-Name =~ / /) {
(3)         if (&User-Name =~ / /)  -> FALSE
(3)         if (&User-Name =~ /@[^@]*@/ ) {
(3)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(3)         if (&User-Name =~ /\.\./ ) {
(3)         if (&User-Name =~ /\.\./ )  -> FALSE
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(3)         if (&User-Name =~ /\.$/)  {
(3)         if (&User-Name =~ /\.$/)   -> FALSE
(3)         if (&User-Name =~ /@\./)  {
(3)         if (&User-Name =~ /@\./)   -> FALSE
(3)       } # if (&User-Name)  = notfound
(3)     } # policy filter_username = notfound
(3)     [preprocess] = ok
(3)     [chap] = noop
(3)     [mschap] = noop
(3)     [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(3) suffix: No such realm "NULL"
(3)     [suffix] = noop
(3) ntdomain: Checking for prefix before "\"
(3) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(3) ntdomain: No such realm "NULL"
(3)     [ntdomain] = noop
(3) eap: Peer sent EAP Response (code 2) ID 4 length 6
(3) eap: Continuing tunnel setup
(3)     [eap] = ok
(3)   } # authorize = ok
(3) Found Auth-Type = eap
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3)   authenticate {
(3) eap: Expiring EAP session with state 0xe102a8b5e306b184
(3) eap: Finished EAP session with state 0xe102a8b5e306b184
(3) eap: Previous EAP request found for state 0xe102a8b5e306b184,
released from the list
(3) eap: Peer sent packet with method EAP PEAP (25)
(3) eap: Calling submodule eap_peap to process data
(3) eap_peap: Continuing EAP-TLS
(3) eap_peap: Peer ACKed our handshake fragment
(3) eap_peap: [eaptls verify] = request
(3) eap_peap: [eaptls process] = handled
(3) eap: Sending EAP Request (code 1) ID 5 length 752
(3) eap: EAP session adding &reply:State = 0xe102a8b5e207b184
(3)     [eap] = handled
(3)   } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3)   Challenge { ... } # empty sub-section is ignored
(3) Sent Access-Challenge Id 76 from 192.168.99.13:1812 to
192.168.99.2:56759 length 0
(3)   EAP-Message =
0x010502f01900260603550403131f5365646c6d6569657220436572746966696361746520417574686f72697479820900b2c4cbf303d91155300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   State = 0xe102a8b5e207b184d77738e9a0e9bb1d
(3) Finished request
Waking up in 3.9 seconds.
(4) Received Access-Request Id 77 from 192.168.99.2:56760 to
192.168.99.13:1812 length 175
(4)   User-Name = "74-2B-62-85-F5-5D"
(4)   Service-Type = Framed-User
(4)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(4)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(4)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(4)   NAS-Port = 5
(4)   NAS-Port-Type = Ethernet
(4)   NAS-Port-Id = "fe.1.5"
(4)   NAS-IP-Address = 0.0.0.0
(4)   User-Password = "NOPASSWORD"
(4)   Message-Authenticator = 0x0beb8902a9e8cbc749b20a3d7d013e57
(4) # Executing section authorize from file /etc/raddb/sites-enabled/default
(4)   authorize {
(4)     policy filter_username {
(4)       if (&User-Name) {
(4)       if (&User-Name)  -> TRUE
(4)       if (&User-Name)  {
(4)         if (&User-Name =~ / /) {
(4)         if (&User-Name =~ / /)  -> FALSE
(4)         if (&User-Name =~ /@[^@]*@/ ) {
(4)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(4)         if (&User-Name =~ /\.\./ ) {
(4)         if (&User-Name =~ /\.\./ )  -> FALSE
(4)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(4)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(4)         if (&User-Name =~ /\.$/)  {
(4)         if (&User-Name =~ /\.$/)   -> FALSE
(4)         if (&User-Name =~ /@\./)  {
(4)         if (&User-Name =~ /@\./)   -> FALSE
(4)       } # if (&User-Name)  = notfound
(4)     } # policy filter_username = notfound
(4)     [preprocess] = ok
(4)     [chap] = noop
(4)     [mschap] = noop
(4)     [digest] = noop
(4) suffix: Checking for suffix after "@"
(4) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(4) suffix: No such realm "NULL"
(4)     [suffix] = noop
(4) ntdomain: Checking for prefix before "\"
(4) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(4) ntdomain: No such realm "NULL"
(4)     [ntdomain] = noop
(4) eap: No EAP-Message, not doing EAP
(4)     [eap] = noop
(4) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Reserved connection (0)
(4) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(4) files:    --> (samaccountname=74-2B-62-85-F5-5D)
(4) files: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(4) files: Waiting for search result...
(4) files: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 5 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(4) files: users: Matched entry DEFAULT at line 48
(4)     [files] = ok
rlm_ldap (ldap): Reserved connection (1)
(4) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(4) ldap:    --> (samaccountname=74-2B-62-85-F5-5D)
(4) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(4) ldap: Waiting for search result...
(4) ldap: Search returned no results
rlm_ldap (ldap): Released connection (1)
(4)     [ldap] = notfound
(4)     [expiration] = noop
(4)     [logintime] = noop
(4) pap: WARNING: Auth-Type already set.  Not setting to PAP
(4)     [pap] = noop
(4)   } # authorize = ok
(4) Found Auth-Type = Reject
(4) Auth-Type = Reject, rejecting user
(4) Failed to authenticate the user
(4) Using Post-Auth-Type Reject
(4) # Executing group from file /etc/raddb/sites-enabled/default
(4)   Post-Auth-Type REJECT {
(4) attr_filter.access_reject: EXPAND %{User-Name}
(4) attr_filter.access_reject:    --> 74-2B-62-85-F5-5D
(4) attr_filter.access_reject: Matched entry DEFAULT at line 11
(4)     [attr_filter.access_reject] = updated
(4)     [eap] = noop
(4)     policy remove_reply_message_if_eap {
(4)       if (&reply:EAP-Message && &reply:Reply-Message) {
(4)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(4)       else {
(4)         [noop] = noop
(4)       } # else = noop
(4)     } # policy remove_reply_message_if_eap = noop
(4)   } # Post-Auth-Type REJECT = updated
(4) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(4) Sending delayed response
(4) Sent Access-Reject Id 77 from 192.168.99.13:1812 to
192.168.99.2:56760 length 20
Waking up in 1.0 seconds.
(0) Cleaning up request packet ID 73 with timestamp +28
Waking up in 1.0 seconds.
(1) Cleaning up request packet ID 74 with timestamp +29
(2) Cleaning up request packet ID 75 with timestamp +29
(3) Cleaning up request packet ID 76 with timestamp +29
Waking up in 1.9 seconds.
(4) Cleaning up request packet ID 77 with timestamp +31
Ready to process requests
(5) Received Access-Request Id 78 from 192.168.99.2:56761 to
192.168.99.13:1812 length 334
(5)   User-Name = "host/rob-nb-3302.sedlmeier.local"
(5)   Service-Type = Framed-User
(5)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(5)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(5)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(5)   NAS-Port = 5
(5)   NAS-Port-Id = "fe.1.5"
(5)   Framed-MTU = 1500
(5)   NAS-Port-Type = Ethernet
(5)   State = 0xe102a8b5e207b184d77738e9a0e9bb1d
(5)   EAP-Message =
0x0205008819800000007e160303004610000042410459577e7f63893e12439d89ef7762dad67749be48f7e06e4798b09f06a920a47cf785564d5fd7220bb11a3f2f7395c2c8c698f67528e9750d194e81d0046fa3211403030001011603030028000000000000000044f35649eebe0522c431f1c3773c53
(5)   NAS-IP-Address = 0.0.0.0
(5)   Message-Authenticator = 0x4a79037a8376770b58ea48e0122addc7
(5) session-state: No cached attributes
(5) # Executing section authorize from file /etc/raddb/sites-enabled/default
(5)   authorize {
(5)     policy filter_username {
(5)       if (&User-Name) {
(5)       if (&User-Name)  -> TRUE
(5)       if (&User-Name)  {
(5)         if (&User-Name =~ / /) {
(5)         if (&User-Name =~ / /)  -> FALSE
(5)         if (&User-Name =~ /@[^@]*@/ ) {
(5)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(5)         if (&User-Name =~ /\.\./ ) {
(5)         if (&User-Name =~ /\.\./ )  -> FALSE
(5)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(5)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(5)         if (&User-Name =~ /\.$/)  {
(5)         if (&User-Name =~ /\.$/)   -> FALSE
(5)         if (&User-Name =~ /@\./)  {
(5)         if (&User-Name =~ /@\./)   -> FALSE
(5)       } # if (&User-Name)  = notfound
(5)     } # policy filter_username = notfound
(5)     [preprocess] = ok
(5)     [chap] = noop
(5)     [mschap] = noop
(5)     [digest] = noop
(5) suffix: Checking for suffix after "@"
(5) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(5) suffix: No such realm "NULL"
(5)     [suffix] = noop
(5) ntdomain: Checking for prefix before "\"
(5) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(5) ntdomain: No such realm "NULL"
(5)     [ntdomain] = noop
(5) eap: Peer sent EAP Response (code 2) ID 5 length 136
(5) eap: Continuing tunnel setup
(5)     [eap] = ok
(5)   } # authorize = ok
(5) Found Auth-Type = eap
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5)   authenticate {
(5) eap: Expiring EAP session with state 0xe102a8b5e207b184
(5) eap: Finished EAP session with state 0xe102a8b5e207b184
(5) eap: Previous EAP request found for state 0xe102a8b5e207b184,
released from the list
(5) eap: Peer sent packet with method EAP PEAP (25)
(5) eap: Calling submodule eap_peap to process data
(5) eap_peap: Continuing EAP-TLS
(5) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(5) eap_peap: Got complete TLS record (126 bytes)
(5) eap_peap: [eaptls verify] = length included
(5) eap_peap: <<< recv TLS 1.2  [length 0046]
(5) eap_peap: TLS_accept: SSLv3 read client key exchange A
(5) eap_peap: <<< recv TLS 1.2  [length 0001]
(5) eap_peap: <<< recv TLS 1.2  [length 0010]
(5) eap_peap: TLS_accept: SSLv3 read finished A
(5) eap_peap: >>> send TLS 1.2  [length 0001]
(5) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(5) eap_peap: >>> send TLS 1.2  [length 0010]
(5) eap_peap: TLS_accept: SSLv3 write finished A
(5) eap_peap: TLS_accept: SSLv3 flush data
(5) eap_peap: (other): SSL negotiation finished successfully
(5) eap_peap: SSL Connection Established
(5) eap_peap: [eaptls process] = handled
(5) eap: Sending EAP Request (code 1) ID 6 length 57
(5) eap: EAP session adding &reply:State = 0xe102a8b5e504b184
(5)     [eap] = handled
(5)   } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5)   Challenge { ... } # empty sub-section is ignored
(5) Sent Access-Challenge Id 78 from 192.168.99.13:1812 to
192.168.99.2:56761 length 0
(5)   EAP-Message =
0x01060039190014030300010116030300284cc3e20a68955d07f6d14e1174f4d7e3213ca011d95b07b99cdabfdaee2088c3000f9d130635ebac
(5)   Message-Authenticator = 0x00000000000000000000000000000000
(5)   State = 0xe102a8b5e504b184d77738e9a0e9bb1d
(5) Finished request
Waking up in 4.9 seconds.
(6) Received Access-Request Id 79 from 192.168.99.2:56762 to
192.168.99.13:1812 length 179
(6)   User-Name = "SEDLMEIER\\iah"
(6)   Service-Type = Framed-User
(6)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(6)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(6)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(6)   NAS-Port = 5
(6)   NAS-Port-Id = "fe.1.5"
(6)   Framed-MTU = 1500
(6)   NAS-Port-Type = Ethernet
(6)   EAP-Message = 0x02020012015345444c4d454945525c696168
(6)   NAS-IP-Address = 0.0.0.0
(6)   Message-Authenticator = 0x818fa39dfffe9c77183d6e2de38d755b
(6) # Executing section authorize from file /etc/raddb/sites-enabled/default
(6)   authorize {
(6)     policy filter_username {
(6)       if (&User-Name) {
(6)       if (&User-Name)  -> TRUE
(6)       if (&User-Name)  {
(6)         if (&User-Name =~ / /) {
(6)         if (&User-Name =~ / /)  -> FALSE
(6)         if (&User-Name =~ /@[^@]*@/ ) {
(6)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(6)         if (&User-Name =~ /\.\./ ) {
(6)         if (&User-Name =~ /\.\./ )  -> FALSE
(6)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(6)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(6)         if (&User-Name =~ /\.$/)  {
(6)         if (&User-Name =~ /\.$/)   -> FALSE
(6)         if (&User-Name =~ /@\./)  {
(6)         if (&User-Name =~ /@\./)   -> FALSE
(6)       } # if (&User-Name)  = notfound
(6)     } # policy filter_username = notfound
(6)     [preprocess] = ok
(6)     [chap] = noop
(6)     [mschap] = noop
(6)     [digest] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(6) suffix: No such realm "NULL"
(6)     [suffix] = noop
(6) ntdomain: Checking for prefix before "\"
(6) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(6) ntdomain: Found realm "SEDLMEIER"
(6) ntdomain: Adding Stripped-User-Name = "iah"
(6) ntdomain: Adding Realm = "SEDLMEIER"
(6) ntdomain: Authentication realm is LOCAL
(6)     [ntdomain] = ok
(6) eap: Peer sent EAP Response (code 2) ID 2 length 18
(6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(6)     [eap] = ok
(6)   } # authorize = ok
(6) Found Auth-Type = eap
(6) # Executing group from file /etc/raddb/sites-enabled/default
(6)   authenticate {
(6) eap: Peer sent packet with method EAP Identity (1)
(6) eap: Calling submodule eap_peap to process data
(6) eap_peap: Initiating new EAP-TLS session
(6) eap_peap: [eaptls start] = request
(6) eap: Sending EAP Request (code 1) ID 3 length 6
(6) eap: EAP session adding &reply:State = 0x5c12086c5c1111e3
(6)     [eap] = handled
(6)   } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) # Executing group from file /etc/raddb/sites-enabled/default
(6)   Challenge { ... } # empty sub-section is ignored
(6) Sent Access-Challenge Id 79 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(6)   EAP-Message = 0x010300061920
(6)   Message-Authenticator = 0x00000000000000000000000000000000
(6)   State = 0x5c12086c5c1111e339ba0cfb20b713d6
(6) Finished request
Waking up in 1.1 seconds.
(7) Received Access-Request Id 80 from 192.168.99.2:56762 to
192.168.99.13:1812 length 349
(7)   User-Name = "SEDLMEIER\\iah"
(7)   Service-Type = Framed-User
(7)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(7)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(7)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(7)   NAS-Port = 5
(7)   NAS-Port-Id = "fe.1.5"
(7)   Framed-MTU = 1500
(7)   NAS-Port-Type = Ethernet
(7)   State = 0x5c12086c5c1111e339ba0cfb20b713d6
(7)   EAP-Message =
0x020300aa1980000000a0160303009b010000970303597ef3af9297418508522f64df28c68dac427ff745468f6dfd57682f35d5132700002ec02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a0005000401000040000500050100000000000a0008
(7)   NAS-IP-Address = 0.0.0.0
(7)   Message-Authenticator = 0x97a8f22303c5ea6c0e824b9e8a1b0aed
(7) session-state: No cached attributes
(7) # Executing section authorize from file /etc/raddb/sites-enabled/default
(7)   authorize {
(7)     policy filter_username {
(7)       if (&User-Name) {
(7)       if (&User-Name)  -> TRUE
(7)       if (&User-Name)  {
(7)         if (&User-Name =~ / /) {
(7)         if (&User-Name =~ / /)  -> FALSE
(7)         if (&User-Name =~ /@[^@]*@/ ) {
(7)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(7)         if (&User-Name =~ /\.\./ ) {
(7)         if (&User-Name =~ /\.\./ )  -> FALSE
(7)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(7)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(7)         if (&User-Name =~ /\.$/)  {
(7)         if (&User-Name =~ /\.$/)   -> FALSE
(7)         if (&User-Name =~ /@\./)  {
(7)         if (&User-Name =~ /@\./)   -> FALSE
(7)       } # if (&User-Name)  = notfound
(7)     } # policy filter_username = notfound
(7)     [preprocess] = ok
(7)     [chap] = noop
(7)     [mschap] = noop
(7)     [digest] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(7) suffix: No such realm "NULL"
(7)     [suffix] = noop
(7) ntdomain: Checking for prefix before "\"
(7) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(7) ntdomain: Found realm "SEDLMEIER"
(7) ntdomain: Adding Stripped-User-Name = "iah"
(7) ntdomain: Adding Realm = "SEDLMEIER"
(7) ntdomain: Authentication realm is LOCAL
(7)     [ntdomain] = ok
(7) eap: Peer sent EAP Response (code 2) ID 3 length 170
(7) eap: Continuing tunnel setup
(7)     [eap] = ok
(7)   } # authorize = ok
(7) Found Auth-Type = eap
(7) # Executing group from file /etc/raddb/sites-enabled/default
(7)   authenticate {
(7) eap: Expiring EAP session with state 0xe102a8b5e504b184
(7) eap: Finished EAP session with state 0x5c12086c5c1111e3
(7) eap: Previous EAP request found for state 0x5c12086c5c1111e3,
released from the list
(7) eap: Peer sent packet with method EAP PEAP (25)
(7) eap: Calling submodule eap_peap to process data
(7) eap_peap: Continuing EAP-TLS
(7) eap_peap: Peer indicated complete TLS record size will be 160 bytes
(7) eap_peap: Got complete TLS record (160 bytes)
(7) eap_peap: [eaptls verify] = length included
(7) eap_peap: (other): before/accept initialization
(7) eap_peap: TLS_accept: before/accept initialization
(7) eap_peap: <<< recv TLS 1.2  [length 009b]
(7) eap_peap: TLS_accept: SSLv3 read client hello A
(7) eap_peap: >>> send TLS 1.2  [length 0039]
(7) eap_peap: TLS_accept: SSLv3 write server hello A
(7) eap_peap: >>> send TLS 1.2  [length 0910]
(7) eap_peap: TLS_accept: SSLv3 write certificate A
(7) eap_peap: >>> send TLS 1.2  [length 014d]
(7) eap_peap: TLS_accept: SSLv3 write key exchange A
(7) eap_peap: >>> send TLS 1.2  [length 0004]
(7) eap_peap: TLS_accept: SSLv3 write server done A
(7) eap_peap: TLS_accept: SSLv3 flush data
(7) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(7) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(7) eap_peap: In SSL Handshake Phase
(7) eap_peap: In SSL Accept mode
(7) eap_peap: [eaptls process] = handled
(7) eap: Sending EAP Request (code 1) ID 4 length 1004
(7) eap: EAP session adding &reply:State = 0x5c12086c5d1611e3
(7)     [eap] = handled
(7)   } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) # Executing group from file /etc/raddb/sites-enabled/default
(7)   Challenge { ... } # empty sub-section is ignored
(7) Sent Access-Challenge Id 80 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(7)   EAP-Message =
0x010403ec19c000000aae1603030039020000350303597ef3aea467f059676c2603a5b2dc766323afffc5e40ce4949e372f640afdc500c03000000dff01000100000b00040300010216030309100b00090c0009090003f7308203f3308202dba003020102020101300d06092a864886f70d01010b050030
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0x5c12086c5d1611e339ba0cfb20b713d6
(7) Finished request
Waking up in 0.2 seconds.
(8) Received Access-Request Id 81 from 192.168.99.2:56762 to
192.168.99.13:1812 length 185
(8)   User-Name = "SEDLMEIER\\iah"
(8)   Service-Type = Framed-User
(8)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(8)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(8)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(8)   NAS-Port = 5
(8)   NAS-Port-Id = "fe.1.5"
(8)   Framed-MTU = 1500
(8)   NAS-Port-Type = Ethernet
(8)   State = 0x5c12086c5d1611e339ba0cfb20b713d6
(8)   EAP-Message = 0x020400061900
(8)   NAS-IP-Address = 0.0.0.0
(8)   Message-Authenticator = 0x2fa5145d6891b5151d53b6b1094c19c5
(8) session-state: No cached attributes
(8) # Executing section authorize from file /etc/raddb/sites-enabled/default
(8)   authorize {
(8)     policy filter_username {
(8)       if (&User-Name) {
(8)       if (&User-Name)  -> TRUE
(8)       if (&User-Name)  {
(8)         if (&User-Name =~ / /) {
(8)         if (&User-Name =~ / /)  -> FALSE
(8)         if (&User-Name =~ /@[^@]*@/ ) {
(8)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(8)         if (&User-Name =~ /\.\./ ) {
(8)         if (&User-Name =~ /\.\./ )  -> FALSE
(8)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(8)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(8)         if (&User-Name =~ /\.$/)  {
(8)         if (&User-Name =~ /\.$/)   -> FALSE
(8)         if (&User-Name =~ /@\./)  {
(8)         if (&User-Name =~ /@\./)   -> FALSE
(8)       } # if (&User-Name)  = notfound
(8)     } # policy filter_username = notfound
(8)     [preprocess] = ok
(8)     [chap] = noop
(8)     [mschap] = noop
(8)     [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(8) suffix: No such realm "NULL"
(8)     [suffix] = noop
(8) ntdomain: Checking for prefix before "\"
(8) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(8) ntdomain: Found realm "SEDLMEIER"
(8) ntdomain: Adding Stripped-User-Name = "iah"
(8) ntdomain: Adding Realm = "SEDLMEIER"
(8) ntdomain: Authentication realm is LOCAL
(8)     [ntdomain] = ok
(8) eap: Peer sent EAP Response (code 2) ID 4 length 6
(8) eap: Continuing tunnel setup
(8)     [eap] = ok
(8)   } # authorize = ok
(8) Found Auth-Type = eap
(8) # Executing group from file /etc/raddb/sites-enabled/default
(8)   authenticate {
(8) eap: Expiring EAP session with state 0xe102a8b5e504b184
(8) eap: Finished EAP session with state 0x5c12086c5d1611e3
(8) eap: Previous EAP request found for state 0x5c12086c5d1611e3,
released from the list
(8) eap: Peer sent packet with method EAP PEAP (25)
(8) eap: Calling submodule eap_peap to process data
(8) eap_peap: Continuing EAP-TLS
(8) eap_peap: Peer ACKed our handshake fragment
(8) eap_peap: [eaptls verify] = request
(8) eap_peap: [eaptls process] = handled
(8) eap: Sending EAP Request (code 1) ID 5 length 1000
(8) eap: EAP session adding &reply:State = 0x5c12086c5e1711e3
(8)     [eap] = handled
(8)   } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) # Executing group from file /etc/raddb/sites-enabled/default
(8)   Challenge { ... } # empty sub-section is ignored
(8) Sent Access-Challenge Id 81 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(8)   EAP-Message =
0x010503e8194022518c1dec2cbb2f69d25320c61e68c7f0b7c8b0ae456881bf11f25fb4734527d9e23825158b087c6fd71853cbc94218fa747fbb854f8a6b48583f69cffde05d5cd8c71c2eab8f1cbfd016db9ee4fbfda2bba6b46ea1587e1118771bad825657998f00050c30820508308203f0a0030201
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8)   State = 0x5c12086c5e1711e339ba0cfb20b713d6
(8) Finished request
Waking up in 0.1 seconds.
(9) Received Access-Request Id 82 from 192.168.99.2:56762 to
192.168.99.13:1812 length 185
(9)   User-Name = "SEDLMEIER\\iah"
(9)   Service-Type = Framed-User
(9)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(9)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(9)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(9)   NAS-Port = 5
(9)   NAS-Port-Id = "fe.1.5"
(9)   Framed-MTU = 1500
(9)   NAS-Port-Type = Ethernet
(9)   State = 0x5c12086c5e1711e339ba0cfb20b713d6
(9)   EAP-Message = 0x020500061900
(9)   NAS-IP-Address = 0.0.0.0
(9)   Message-Authenticator = 0x2232c98584da081f74bfd46238c649a6
(9) session-state: No cached attributes
(9) # Executing section authorize from file /etc/raddb/sites-enabled/default
(9)   authorize {
(9)     policy filter_username {
(9)       if (&User-Name) {
(9)       if (&User-Name)  -> TRUE
(9)       if (&User-Name)  {
(9)         if (&User-Name =~ / /) {
(9)         if (&User-Name =~ / /)  -> FALSE
(9)         if (&User-Name =~ /@[^@]*@/ ) {
(9)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(9)         if (&User-Name =~ /\.\./ ) {
(9)         if (&User-Name =~ /\.\./ )  -> FALSE
(9)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(9)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(9)         if (&User-Name =~ /\.$/)  {
(9)         if (&User-Name =~ /\.$/)   -> FALSE
(9)         if (&User-Name =~ /@\./)  {
(9)         if (&User-Name =~ /@\./)   -> FALSE
(9)       } # if (&User-Name)  = notfound
(9)     } # policy filter_username = notfound
(9)     [preprocess] = ok
(9)     [chap] = noop
(9)     [mschap] = noop
(9)     [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(9) suffix: No such realm "NULL"
(9)     [suffix] = noop
(9) ntdomain: Checking for prefix before "\"
(9) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(9) ntdomain: Found realm "SEDLMEIER"
(9) ntdomain: Adding Stripped-User-Name = "iah"
(9) ntdomain: Adding Realm = "SEDLMEIER"
(9) ntdomain: Authentication realm is LOCAL
(9)     [ntdomain] = ok
(9) eap: Peer sent EAP Response (code 2) ID 5 length 6
(9) eap: Continuing tunnel setup
(9)     [eap] = ok
(9)   } # authorize = ok
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9)   authenticate {
(9) eap: Expiring EAP session with state 0xe102a8b5e504b184
(9) eap: Finished EAP session with state 0x5c12086c5e1711e3
(9) eap: Previous EAP request found for state 0x5c12086c5e1711e3,
released from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: Continuing EAP-TLS
(9) eap_peap: Peer ACKed our handshake fragment
(9) eap_peap: [eaptls verify] = request
(9) eap_peap: [eaptls process] = handled
(9) eap: Sending EAP Request (code 1) ID 6 length 752
(9) eap: EAP session adding &reply:State = 0x5c12086c5f1411e3
(9)     [eap] = handled
(9)   } # authenticate = handled
(9) Using Post-Auth-Type Challenge
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9)   Challenge { ... } # empty sub-section is ignored
(9) Sent Access-Challenge Id 82 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(9)   EAP-Message =
0x010602f01900260603550403131f5365646c6d6569657220436572746966696361746520417574686f72697479820900b2c4cbf303d91155300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d
(9)   Message-Authenticator = 0x00000000000000000000000000000000
(9)   State = 0x5c12086c5f1411e339ba0cfb20b713d6
(9) Finished request
Waking up in 0.1 seconds.
(10) Received Access-Request Id 83 from 192.168.99.2:56762 to
192.168.99.13:1812 length 315
(10)   User-Name = "SEDLMEIER\\iah"
(10)   Service-Type = Framed-User
(10)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(10)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(10)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(10)   NAS-Port = 5
(10)   NAS-Port-Id = "fe.1.5"
(10)   Framed-MTU = 1500
(10)   NAS-Port-Type = Ethernet
(10)   State = 0x5c12086c5f1411e339ba0cfb20b713d6
(10)   EAP-Message =
0x0206008819800000007e16030300461000004241049c2e77d6fcc8cdca527b6a1ec38a7f6f2051615194c3105208b13f10613e8e52ff33d0b56a501b57117d9b5e1741b10d41ccd01e9b01944566873455ca522b911403030001011603030028000000000000000075256bb4eee5e1fbb9e017d492512f
(10)   NAS-IP-Address = 0.0.0.0
(10)   Message-Authenticator = 0x08422fb47023c883ae6834405b9141b8
(10) session-state: No cached attributes
(10) # Executing section authorize from file /etc/raddb/sites-enabled/default
(10)   authorize {
(10)     policy filter_username {
(10)       if (&User-Name) {
(10)       if (&User-Name)  -> TRUE
(10)       if (&User-Name)  {
(10)         if (&User-Name =~ / /) {
(10)         if (&User-Name =~ / /)  -> FALSE
(10)         if (&User-Name =~ /@[^@]*@/ ) {
(10)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(10)         if (&User-Name =~ /\.\./ ) {
(10)         if (&User-Name =~ /\.\./ )  -> FALSE
(10)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(10)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(10)         if (&User-Name =~ /\.$/)  {
(10)         if (&User-Name =~ /\.$/)   -> FALSE
(10)         if (&User-Name =~ /@\./)  {
(10)         if (&User-Name =~ /@\./)   -> FALSE
(10)       } # if (&User-Name)  = notfound
(10)     } # policy filter_username = notfound
(10)     [preprocess] = ok
(10)     [chap] = noop
(10)     [mschap] = noop
(10)     [digest] = noop
(10) suffix: Checking for suffix after "@"
(10) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(10) suffix: No such realm "NULL"
(10)     [suffix] = noop
(10) ntdomain: Checking for prefix before "\"
(10) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(10) ntdomain: Found realm "SEDLMEIER"
(10) ntdomain: Adding Stripped-User-Name = "iah"
(10) ntdomain: Adding Realm = "SEDLMEIER"
(10) ntdomain: Authentication realm is LOCAL
(10)     [ntdomain] = ok
(10) eap: Peer sent EAP Response (code 2) ID 6 length 136
(10) eap: Continuing tunnel setup
(10)     [eap] = ok
(10)   } # authorize = ok
(10) Found Auth-Type = eap
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10)   authenticate {
(10) eap: Expiring EAP session with state 0xe102a8b5e504b184
(10) eap: Finished EAP session with state 0x5c12086c5f1411e3
(10) eap: Previous EAP request found for state 0x5c12086c5f1411e3,
released from the list
(10) eap: Peer sent packet with method EAP PEAP (25)
(10) eap: Calling submodule eap_peap to process data
(10) eap_peap: Continuing EAP-TLS
(10) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(10) eap_peap: Got complete TLS record (126 bytes)
(10) eap_peap: [eaptls verify] = length included
(10) eap_peap: <<< recv TLS 1.2  [length 0046]
(10) eap_peap: TLS_accept: SSLv3 read client key exchange A
(10) eap_peap: <<< recv TLS 1.2  [length 0001]
(10) eap_peap: <<< recv TLS 1.2  [length 0010]
(10) eap_peap: TLS_accept: SSLv3 read finished A
(10) eap_peap: >>> send TLS 1.2  [length 0001]
(10) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(10) eap_peap: >>> send TLS 1.2  [length 0010]
(10) eap_peap: TLS_accept: SSLv3 write finished A
(10) eap_peap: TLS_accept: SSLv3 flush data
(10) eap_peap: (other): SSL negotiation finished successfully
(10) eap_peap: SSL Connection Established
(10) eap_peap: [eaptls process] = handled
(10) eap: Sending EAP Request (code 1) ID 7 length 57
(10) eap: EAP session adding &reply:State = 0x5c12086c581511e3
(10)     [eap] = handled
(10)   } # authenticate = handled
(10) Using Post-Auth-Type Challenge
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10)   Challenge { ... } # empty sub-section is ignored
(10) Sent Access-Challenge Id 83 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(10)   EAP-Message =
0x010700391900140303000101160303002851bcfc40abac086065a05953d280fd982896b0423fcc9ea154fe46ffb652a382e869902394c3d1f3
(10)   Message-Authenticator = 0x00000000000000000000000000000000
(10)   State = 0x5c12086c581511e339ba0cfb20b713d6
(10) Finished request
Waking up in 0.1 seconds.
(5) Cleaning up request packet ID 78 with timestamp +56
Waking up in 3.8 seconds.
(11) Received Access-Request Id 84 from 192.168.99.2:56763 to
192.168.99.13:1812 length 175
(11)   User-Name = "74-2B-62-85-F5-5D"
(11)   Service-Type = Framed-User
(11)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(11)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(11)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(11)   NAS-Port = 5
(11)   NAS-Port-Type = Ethernet
(11)   NAS-Port-Id = "fe.1.5"
(11)   NAS-IP-Address = 0.0.0.0
(11)   User-Password = "NOPASSWORD"
(11)   Message-Authenticator = 0x6f080d4ccbf6f5ca720db06ca1ded019
(11) # Executing section authorize from file /etc/raddb/sites-enabled/default
(11)   authorize {
(11)     policy filter_username {
(11)       if (&User-Name) {
(11)       if (&User-Name)  -> TRUE
(11)       if (&User-Name)  {
(11)         if (&User-Name =~ / /) {
(11)         if (&User-Name =~ / /)  -> FALSE
(11)         if (&User-Name =~ /@[^@]*@/ ) {
(11)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(11)         if (&User-Name =~ /\.\./ ) {
(11)         if (&User-Name =~ /\.\./ )  -> FALSE
(11)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(11)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(11)         if (&User-Name =~ /\.$/)  {
(11)         if (&User-Name =~ /\.$/)   -> FALSE
(11)         if (&User-Name =~ /@\./)  {
(11)         if (&User-Name =~ /@\./)   -> FALSE
(11)       } # if (&User-Name)  = notfound
(11)     } # policy filter_username = notfound
(11)     [preprocess] = ok
(11)     [chap] = noop
(11)     [mschap] = noop
(11)     [digest] = noop
(11) suffix: Checking for suffix after "@"
(11) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(11) suffix: No such realm "NULL"
(11)     [suffix] = noop
(11) ntdomain: Checking for prefix before "\"
(11) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(11) ntdomain: No such realm "NULL"
(11)     [ntdomain] = noop
(11) eap: No EAP-Message, not doing EAP
(11)     [eap] = noop
(11) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Reserved connection (0)
(11) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(11) files:    --> (samaccountname=74-2B-62-85-F5-5D)
(11) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(11) files: Waiting for search result...
(11) files: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 7 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (6), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(11) files: users: Matched entry DEFAULT at line 48
(11)     [files] = ok
rlm_ldap (ldap): Reserved connection (5)
(11) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(11) ldap:    --> (samaccountname=74-2B-62-85-F5-5D)
(11) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(11) ldap: Waiting for search result...
(11) ldap: Search returned no results
rlm_ldap (ldap): Released connection (5)
(11)     [ldap] = notfound
(11)     [expiration] = noop
(11)     [logintime] = noop
(11) pap: WARNING: Auth-Type already set.  Not setting to PAP
(11)     [pap] = noop
(11)   } # authorize = ok
(11) Found Auth-Type = Reject
(11) Auth-Type = Reject, rejecting user
(11) Failed to authenticate the user
(11) Using Post-Auth-Type Reject
(11) # Executing group from file /etc/raddb/sites-enabled/default
(11)   Post-Auth-Type REJECT {
(11) attr_filter.access_reject: EXPAND %{User-Name}
(11) attr_filter.access_reject:    --> 74-2B-62-85-F5-5D
(11) attr_filter.access_reject: Matched entry DEFAULT at line 11
(11)     [attr_filter.access_reject] = updated
(11)     [eap] = noop
(11)     policy remove_reply_message_if_eap {
(11)       if (&reply:EAP-Message && &reply:Reply-Message) {
(11)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(11)       else {
(11)         [noop] = noop
(11)       } # else = noop
(11)     } # policy remove_reply_message_if_eap = noop
(11)   } # Post-Auth-Type REJECT = updated
(11) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(11) Sending delayed response
(11) Sent Access-Reject Id 84 from 192.168.99.13:1812 to
192.168.99.2:56763 length 20
Waking up in 1.1 seconds.
(6) Cleaning up request packet ID 79 with timestamp +60
Waking up in 0.9 seconds.
(7) Cleaning up request packet ID 80 with timestamp +61
(8) Cleaning up request packet ID 81 with timestamp +61
(9) Cleaning up request packet ID 82 with timestamp +61
(10) Cleaning up request packet ID 83 with timestamp +61
Waking up in 1.8 seconds.
(11) Cleaning up request packet ID 84 with timestamp +63
Ready to process requests
(12) Received Access-Request Id 85 from 192.168.99.2:56764 to
192.168.99.13:1812 length 175
(12)   User-Name = "74-2B-62-85-F5-5D"
(12)   Service-Type = Framed-User
(12)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(12)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(12)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(12)   NAS-Port = 5
(12)   NAS-Port-Type = Ethernet
(12)   NAS-Port-Id = "fe.1.5"
(12)   NAS-IP-Address = 0.0.0.0
(12)   User-Password = "NOPASSWORD"
(12)   Message-Authenticator = 0xeec36b77f7b50adfba1207e2034ef1a1
(12) # Executing section authorize from file /etc/raddb/sites-enabled/default
(12)   authorize {
(12)     policy filter_username {
(12)       if (&User-Name) {
(12)       if (&User-Name)  -> TRUE
(12)       if (&User-Name)  {
(12)         if (&User-Name =~ / /) {
(12)         if (&User-Name =~ / /)  -> FALSE
(12)         if (&User-Name =~ /@[^@]*@/ ) {
(12)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(12)         if (&User-Name =~ /\.\./ ) {
(12)         if (&User-Name =~ /\.\./ )  -> FALSE
(12)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(12)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(12)         if (&User-Name =~ /\.$/)  {
(12)         if (&User-Name =~ /\.$/)   -> FALSE
(12)         if (&User-Name =~ /@\./)  {
(12)         if (&User-Name =~ /@\./)   -> FALSE
(12)       } # if (&User-Name)  = notfound
(12)     } # policy filter_username = notfound
(12)     [preprocess] = ok
(12)     [chap] = noop
(12)     [mschap] = noop
(12)     [digest] = noop
(12) suffix: Checking for suffix after "@"
(12) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(12) suffix: No such realm "NULL"
(12)     [suffix] = noop
(12) ntdomain: Checking for prefix before "\"
(12) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(12) ntdomain: No such realm "NULL"
(12)     [ntdomain] = noop
(12) eap: No EAP-Message, not doing EAP
(12)     [eap] = noop
(12) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle
for 64 seconds
rlm_ldap (ldap): Reserved connection (0)
(12) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(12) files:    --> (samaccountname=74-2B-62-85-F5-5D)
(12) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(12) files: Waiting for search result...
(12) files: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 7 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (7), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(12) files: users: Matched entry DEFAULT at line 48
(12)     [files] = ok
rlm_ldap (ldap): Reserved connection (6)
(12) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(12) ldap:    --> (samaccountname=74-2B-62-85-F5-5D)
(12) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(12) ldap: Waiting for search result...
(12) ldap: Search returned no results
rlm_ldap (ldap): Released connection (6)
(12)     [ldap] = notfound
(12)     [expiration] = noop
(12)     [logintime] = noop
(12) pap: WARNING: Auth-Type already set.  Not setting to PAP
(12)     [pap] = noop
(12)   } # authorize = ok
(12) Found Auth-Type = Reject
(12) Auth-Type = Reject, rejecting user
(12) Failed to authenticate the user
(12) Using Post-Auth-Type Reject
(12) # Executing group from file /etc/raddb/sites-enabled/default
(12)   Post-Auth-Type REJECT {
(12) attr_filter.access_reject: EXPAND %{User-Name}
(12) attr_filter.access_reject:    --> 74-2B-62-85-F5-5D
(12) attr_filter.access_reject: Matched entry DEFAULT at line 11
(12)     [attr_filter.access_reject] = updated
(12)     [eap] = noop
(12)     policy remove_reply_message_if_eap {
(12)       if (&reply:EAP-Message && &reply:Reply-Message) {
(12)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(12)       else {
(12)         [noop] = noop
(12)       } # else = noop
(12)     } # policy remove_reply_message_if_eap = noop
(12)   } # Post-Auth-Type REJECT = updated
(12) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(12) Sending delayed response
(12) Sent Access-Reject Id 85 from 192.168.99.13:1812 to
192.168.99.2:56764 length 20
Waking up in 3.9 seconds.
(12) Cleaning up request packet ID 85 with timestamp +95
Ready to process requests
(13) Received Access-Request Id 86 from 192.168.99.2:56765 to
192.168.99.13:1812 length 179
(13)   User-Name = "SEDLMEIER\\iah"
(13)   Service-Type = Framed-User
(13)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(13)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(13)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(13)   NAS-Port = 5
(13)   NAS-Port-Id = "fe.1.5"
(13)   Framed-MTU = 1500
(13)   NAS-Port-Type = Ethernet
(13)   EAP-Message = 0x02080012015345444c4d454945525c696168
(13)   NAS-IP-Address = 0.0.0.0
(13)   Message-Authenticator = 0x1b1d08e528d4d368c7099e9a07b3ecf5
(13) # Executing section authorize from file /etc/raddb/sites-enabled/default
(13)   authorize {
(13)     policy filter_username {
(13)       if (&User-Name) {
(13)       if (&User-Name)  -> TRUE
(13)       if (&User-Name)  {
(13)         if (&User-Name =~ / /) {
(13)         if (&User-Name =~ / /)  -> FALSE
(13)         if (&User-Name =~ /@[^@]*@/ ) {
(13)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(13)         if (&User-Name =~ /\.\./ ) {
(13)         if (&User-Name =~ /\.\./ )  -> FALSE
(13)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(13)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(13)         if (&User-Name =~ /\.$/)  {
(13)         if (&User-Name =~ /\.$/)   -> FALSE
(13)         if (&User-Name =~ /@\./)  {
(13)         if (&User-Name =~ /@\./)   -> FALSE
(13)       } # if (&User-Name)  = notfound
(13)     } # policy filter_username = notfound
(13)     [preprocess] = ok
(13)     [chap] = noop
(13)     [mschap] = noop
(13)     [digest] = noop
(13) suffix: Checking for suffix after "@"
(13) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(13) suffix: No such realm "NULL"
(13)     [suffix] = noop
(13) ntdomain: Checking for prefix before "\"
(13) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(13) ntdomain: Found realm "SEDLMEIER"
(13) ntdomain: Adding Stripped-User-Name = "iah"
(13) ntdomain: Adding Realm = "SEDLMEIER"
(13) ntdomain: Authentication realm is LOCAL
(13)     [ntdomain] = ok
(13) eap: Peer sent EAP Response (code 2) ID 8 length 18
(13) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(13)     [eap] = ok
(13)   } # authorize = ok
(13) Found Auth-Type = eap
(13) # Executing group from file /etc/raddb/sites-enabled/default
(13)   authenticate {
(13) eap: Peer sent packet with method EAP Identity (1)
(13) eap: Calling submodule eap_peap to process data
(13) eap_peap: Initiating new EAP-TLS session
(13) eap_peap: [eaptls start] = request
(13) eap: Sending EAP Request (code 1) ID 9 length 6
(13) eap: EAP session adding &reply:State = 0xd24e2fefd247361e
(13)     [eap] = handled
(13)   } # authenticate = handled
(13) Using Post-Auth-Type Challenge
(13) # Executing group from file /etc/raddb/sites-enabled/default
(13)   Challenge { ... } # empty sub-section is ignored
(13) Sent Access-Challenge Id 86 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(13)   EAP-Message = 0x010900061920
(13)   Message-Authenticator = 0x00000000000000000000000000000000
(13)   State = 0xd24e2fefd247361eca7551413078c7bf
(13) Finished request
Waking up in 4.9 seconds.
(14) Received Access-Request Id 87 from 192.168.99.2:56765 to
192.168.99.13:1812 length 349
(14)   User-Name = "SEDLMEIER\\iah"
(14)   Service-Type = Framed-User
(14)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(14)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(14)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(14)   NAS-Port = 5
(14)   NAS-Port-Id = "fe.1.5"
(14)   Framed-MTU = 1500
(14)   NAS-Port-Type = Ethernet
(14)   State = 0xd24e2fefd247361eca7551413078c7bf
(14)   EAP-Message =
0x020900aa1980000000a0160303009b010000970303597ef3eb3f5f0cdf9d002c82661bdd703d5d6924c837b49643e04172f2686dd900002ec02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a0005000401000040000500050100000000000a0008
(14)   NAS-IP-Address = 0.0.0.0
(14)   Message-Authenticator = 0x3948db8556c9c85fddb72a5b0c0de12d
(14) session-state: No cached attributes
(14) # Executing section authorize from file /etc/raddb/sites-enabled/default
(14)   authorize {
(14)     policy filter_username {
(14)       if (&User-Name) {
(14)       if (&User-Name)  -> TRUE
(14)       if (&User-Name)  {
(14)         if (&User-Name =~ / /) {
(14)         if (&User-Name =~ / /)  -> FALSE
(14)         if (&User-Name =~ /@[^@]*@/ ) {
(14)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(14)         if (&User-Name =~ /\.\./ ) {
(14)         if (&User-Name =~ /\.\./ )  -> FALSE
(14)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(14)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(14)         if (&User-Name =~ /\.$/)  {
(14)         if (&User-Name =~ /\.$/)   -> FALSE
(14)         if (&User-Name =~ /@\./)  {
(14)         if (&User-Name =~ /@\./)   -> FALSE
(14)       } # if (&User-Name)  = notfound
(14)     } # policy filter_username = notfound
(14)     [preprocess] = ok
(14)     [chap] = noop
(14)     [mschap] = noop
(14)     [digest] = noop
(14) suffix: Checking for suffix after "@"
(14) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(14) suffix: No such realm "NULL"
(14)     [suffix] = noop
(14) ntdomain: Checking for prefix before "\"
(14) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(14) ntdomain: Found realm "SEDLMEIER"
(14) ntdomain: Adding Stripped-User-Name = "iah"
(14) ntdomain: Adding Realm = "SEDLMEIER"
(14) ntdomain: Authentication realm is LOCAL
(14)     [ntdomain] = ok
(14) eap: Peer sent EAP Response (code 2) ID 9 length 170
(14) eap: Continuing tunnel setup
(14)     [eap] = ok
(14)   } # authorize = ok
(14) Found Auth-Type = eap
(14) # Executing group from file /etc/raddb/sites-enabled/default
(14)   authenticate {
(14) eap: Expiring EAP session with state 0xe102a8b5e504b184
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! EAP session with state 0xe102a8b5e504b184 did not finish!                  !!
!! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility     !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(14) eap: Expiring EAP session with state 0x5c12086c581511e3
(14) eap: Finished EAP session with state 0xd24e2fefd247361e
(14) eap: Previous EAP request found for state 0xd24e2fefd247361e,
released from the list
(14) eap: Peer sent packet with method EAP PEAP (25)
(14) eap: Calling submodule eap_peap to process data
(14) eap_peap: Continuing EAP-TLS
(14) eap_peap: Peer indicated complete TLS record size will be 160 bytes
(14) eap_peap: Got complete TLS record (160 bytes)
(14) eap_peap: [eaptls verify] = length included
(14) eap_peap: (other): before/accept initialization
(14) eap_peap: TLS_accept: before/accept initialization
(14) eap_peap: <<< recv TLS 1.2  [length 009b]
(14) eap_peap: TLS_accept: SSLv3 read client hello A
(14) eap_peap: >>> send TLS 1.2  [length 0039]
(14) eap_peap: TLS_accept: SSLv3 write server hello A
(14) eap_peap: >>> send TLS 1.2  [length 0910]
(14) eap_peap: TLS_accept: SSLv3 write certificate A
(14) eap_peap: >>> send TLS 1.2  [length 014d]
(14) eap_peap: TLS_accept: SSLv3 write key exchange A
(14) eap_peap: >>> send TLS 1.2  [length 0004]
(14) eap_peap: TLS_accept: SSLv3 write server done A
(14) eap_peap: TLS_accept: SSLv3 flush data
(14) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(14) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(14) eap_peap: In SSL Handshake Phase
(14) eap_peap: In SSL Accept mode
(14) eap_peap: [eaptls process] = handled
(14) eap: Sending EAP Request (code 1) ID 10 length 1004
(14) eap: EAP session adding &reply:State = 0xd24e2fefd344361e
(14)     [eap] = handled
(14)   } # authenticate = handled
(14) Using Post-Auth-Type Challenge
(14) # Executing group from file /etc/raddb/sites-enabled/default
(14)   Challenge { ... } # empty sub-section is ignored
(14) Sent Access-Challenge Id 87 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(14)   EAP-Message =
0x010a03ec19c000000aae1603030039020000350303597ef3e99badfb8693744cdcd7601bd3e974444747f08040cff0d223da1f0c8a00c03000000dff01000100000b00040300010216030309100b00090c0009090003f7308203f3308202dba003020102020101300d06092a864886f70d01010b050030
(14)   Message-Authenticator = 0x00000000000000000000000000000000
(14)   State = 0xd24e2fefd344361eca7551413078c7bf
(14) Finished request
Waking up in 4.9 seconds.
(15) Received Access-Request Id 88 from 192.168.99.2:56765 to
192.168.99.13:1812 length 185
(15)   User-Name = "SEDLMEIER\\iah"
(15)   Service-Type = Framed-User
(15)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(15)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(15)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(15)   NAS-Port = 5
(15)   NAS-Port-Id = "fe.1.5"
(15)   Framed-MTU = 1500
(15)   NAS-Port-Type = Ethernet
(15)   State = 0xd24e2fefd344361eca7551413078c7bf
(15)   EAP-Message = 0x020a00061900
(15)   NAS-IP-Address = 0.0.0.0
(15)   Message-Authenticator = 0xf862a5636affc708d17664f7967df861
(15) session-state: No cached attributes
(15) # Executing section authorize from file /etc/raddb/sites-enabled/default
(15)   authorize {
(15)     policy filter_username {
(15)       if (&User-Name) {
(15)       if (&User-Name)  -> TRUE
(15)       if (&User-Name)  {
(15)         if (&User-Name =~ / /) {
(15)         if (&User-Name =~ / /)  -> FALSE
(15)         if (&User-Name =~ /@[^@]*@/ ) {
(15)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(15)         if (&User-Name =~ /\.\./ ) {
(15)         if (&User-Name =~ /\.\./ )  -> FALSE
(15)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(15)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(15)         if (&User-Name =~ /\.$/)  {
(15)         if (&User-Name =~ /\.$/)   -> FALSE
(15)         if (&User-Name =~ /@\./)  {
(15)         if (&User-Name =~ /@\./)   -> FALSE
(15)       } # if (&User-Name)  = notfound
(15)     } # policy filter_username = notfound
(15)     [preprocess] = ok
(15)     [chap] = noop
(15)     [mschap] = noop
(15)     [digest] = noop
(15) suffix: Checking for suffix after "@"
(15) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(15) suffix: No such realm "NULL"
(15)     [suffix] = noop
(15) ntdomain: Checking for prefix before "\"
(15) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(15) ntdomain: Found realm "SEDLMEIER"
(15) ntdomain: Adding Stripped-User-Name = "iah"
(15) ntdomain: Adding Realm = "SEDLMEIER"
(15) ntdomain: Authentication realm is LOCAL
(15)     [ntdomain] = ok
(15) eap: Peer sent EAP Response (code 2) ID 10 length 6
(15) eap: Continuing tunnel setup
(15)     [eap] = ok
(15)   } # authorize = ok
(15) Found Auth-Type = eap
(15) # Executing group from file /etc/raddb/sites-enabled/default
(15)   authenticate {
(15) eap: Expiring EAP session with state 0x5c12086c581511e3
(15) eap: Finished EAP session with state 0xd24e2fefd344361e
(15) eap: Previous EAP request found for state 0xd24e2fefd344361e,
released from the list
(15) eap: Peer sent packet with method EAP PEAP (25)
(15) eap: Calling submodule eap_peap to process data
(15) eap_peap: Continuing EAP-TLS
(15) eap_peap: Peer ACKed our handshake fragment
(15) eap_peap: [eaptls verify] = request
(15) eap_peap: [eaptls process] = handled
(15) eap: Sending EAP Request (code 1) ID 11 length 1000
(15) eap: EAP session adding &reply:State = 0xd24e2fefd045361e
(15)     [eap] = handled
(15)   } # authenticate = handled
(15) Using Post-Auth-Type Challenge
(15) # Executing group from file /etc/raddb/sites-enabled/default
(15)   Challenge { ... } # empty sub-section is ignored
(15) Sent Access-Challenge Id 88 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(15)   EAP-Message =
0x010b03e8194022518c1dec2cbb2f69d25320c61e68c7f0b7c8b0ae456881bf11f25fb4734527d9e23825158b087c6fd71853cbc94218fa747fbb854f8a6b48583f69cffde05d5cd8c71c2eab8f1cbfd016db9ee4fbfda2bba6b46ea1587e1118771bad825657998f00050c30820508308203f0a0030201
(15)   Message-Authenticator = 0x00000000000000000000000000000000
(15)   State = 0xd24e2fefd045361eca7551413078c7bf
(15) Finished request
Waking up in 4.9 seconds.
(16) Received Access-Request Id 89 from 192.168.99.2:56765 to
192.168.99.13:1812 length 185
(16)   User-Name = "SEDLMEIER\\iah"
(16)   Service-Type = Framed-User
(16)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(16)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(16)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(16)   NAS-Port = 5
(16)   NAS-Port-Id = "fe.1.5"
(16)   Framed-MTU = 1500
(16)   NAS-Port-Type = Ethernet
(16)   State = 0xd24e2fefd045361eca7551413078c7bf
(16)   EAP-Message = 0x020b00061900
(16)   NAS-IP-Address = 0.0.0.0
(16)   Message-Authenticator = 0xb50b422e3023158679ac2bb2da0882ef
(16) session-state: No cached attributes
(16) # Executing section authorize from file /etc/raddb/sites-enabled/default
(16)   authorize {
(16)     policy filter_username {
(16)       if (&User-Name) {
(16)       if (&User-Name)  -> TRUE
(16)       if (&User-Name)  {
(16)         if (&User-Name =~ / /) {
(16)         if (&User-Name =~ / /)  -> FALSE
(16)         if (&User-Name =~ /@[^@]*@/ ) {
(16)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(16)         if (&User-Name =~ /\.\./ ) {
(16)         if (&User-Name =~ /\.\./ )  -> FALSE
(16)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(16)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(16)         if (&User-Name =~ /\.$/)  {
(16)         if (&User-Name =~ /\.$/)   -> FALSE
(16)         if (&User-Name =~ /@\./)  {
(16)         if (&User-Name =~ /@\./)   -> FALSE
(16)       } # if (&User-Name)  = notfound
(16)     } # policy filter_username = notfound
(16)     [preprocess] = ok
(16)     [chap] = noop
(16)     [mschap] = noop
(16)     [digest] = noop
(16) suffix: Checking for suffix after "@"
(16) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(16) suffix: No such realm "NULL"
(16)     [suffix] = noop
(16) ntdomain: Checking for prefix before "\"
(16) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(16) ntdomain: Found realm "SEDLMEIER"
(16) ntdomain: Adding Stripped-User-Name = "iah"
(16) ntdomain: Adding Realm = "SEDLMEIER"
(16) ntdomain: Authentication realm is LOCAL
(16)     [ntdomain] = ok
(16) eap: Peer sent EAP Response (code 2) ID 11 length 6
(16) eap: Continuing tunnel setup
(16)     [eap] = ok
(16)   } # authorize = ok
(16) Found Auth-Type = eap
(16) # Executing group from file /etc/raddb/sites-enabled/default
(16)   authenticate {
(16) eap: Expiring EAP session with state 0x5c12086c581511e3
(16) eap: Finished EAP session with state 0xd24e2fefd045361e
(16) eap: Previous EAP request found for state 0xd24e2fefd045361e,
released from the list
(16) eap: Peer sent packet with method EAP PEAP (25)
(16) eap: Calling submodule eap_peap to process data
(16) eap_peap: Continuing EAP-TLS
(16) eap_peap: Peer ACKed our handshake fragment
(16) eap_peap: [eaptls verify] = request
(16) eap_peap: [eaptls process] = handled
(16) eap: Sending EAP Request (code 1) ID 12 length 752
(16) eap: EAP session adding &reply:State = 0xd24e2fefd142361e
(16)     [eap] = handled
(16)   } # authenticate = handled
(16) Using Post-Auth-Type Challenge
(16) # Executing group from file /etc/raddb/sites-enabled/default
(16)   Challenge { ... } # empty sub-section is ignored
(16) Sent Access-Challenge Id 89 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(16)   EAP-Message =
0x010c02f01900260603550403131f5365646c6d6569657220436572746966696361746520417574686f72697479820900b2c4cbf303d91155300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d
(16)   Message-Authenticator = 0x00000000000000000000000000000000
(16)   State = 0xd24e2fefd142361eca7551413078c7bf
(16) Finished request
Waking up in 4.9 seconds.
(17) Received Access-Request Id 90 from 192.168.99.2:56765 to
192.168.99.13:1812 length 315
(17)   User-Name = "SEDLMEIER\\iah"
(17)   Service-Type = Framed-User
(17)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(17)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(17)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(17)   NAS-Port = 5
(17)   NAS-Port-Id = "fe.1.5"
(17)   Framed-MTU = 1500
(17)   NAS-Port-Type = Ethernet
(17)   State = 0xd24e2fefd142361eca7551413078c7bf
(17)   EAP-Message =
0x020c008819800000007e1603030046100000424104448b22ede4a0e77a739219e3c41aebb4661afdbe06012588afd6bdd0178ea8be11cb65e55b389fce98c8a05ab3468908468bd9531fb1316271bba8f904a6eeb5140303000101160303002800000000000000002b081693acf8713f55f691ee064a87
(17)   NAS-IP-Address = 0.0.0.0
(17)   Message-Authenticator = 0x9929cea011801053b9263e9451e5cb5a
(17) session-state: No cached attributes
(17) # Executing section authorize from file /etc/raddb/sites-enabled/default
(17)   authorize {
(17)     policy filter_username {
(17)       if (&User-Name) {
(17)       if (&User-Name)  -> TRUE
(17)       if (&User-Name)  {
(17)         if (&User-Name =~ / /) {
(17)         if (&User-Name =~ / /)  -> FALSE
(17)         if (&User-Name =~ /@[^@]*@/ ) {
(17)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(17)         if (&User-Name =~ /\.\./ ) {
(17)         if (&User-Name =~ /\.\./ )  -> FALSE
(17)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(17)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(17)         if (&User-Name =~ /\.$/)  {
(17)         if (&User-Name =~ /\.$/)   -> FALSE
(17)         if (&User-Name =~ /@\./)  {
(17)         if (&User-Name =~ /@\./)   -> FALSE
(17)       } # if (&User-Name)  = notfound
(17)     } # policy filter_username = notfound
(17)     [preprocess] = ok
(17)     [chap] = noop
(17)     [mschap] = noop
(17)     [digest] = noop
(17) suffix: Checking for suffix after "@"
(17) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(17) suffix: No such realm "NULL"
(17)     [suffix] = noop
(17) ntdomain: Checking for prefix before "\"
(17) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(17) ntdomain: Found realm "SEDLMEIER"
(17) ntdomain: Adding Stripped-User-Name = "iah"
(17) ntdomain: Adding Realm = "SEDLMEIER"
(17) ntdomain: Authentication realm is LOCAL
(17)     [ntdomain] = ok
(17) eap: Peer sent EAP Response (code 2) ID 12 length 136
(17) eap: Continuing tunnel setup
(17)     [eap] = ok
(17)   } # authorize = ok
(17) Found Auth-Type = eap
(17) # Executing group from file /etc/raddb/sites-enabled/default
(17)   authenticate {
(17) eap: Expiring EAP session with state 0x5c12086c581511e3
(17) eap: Finished EAP session with state 0xd24e2fefd142361e
(17) eap: Previous EAP request found for state 0xd24e2fefd142361e,
released from the list
(17) eap: Peer sent packet with method EAP PEAP (25)
(17) eap: Calling submodule eap_peap to process data
(17) eap_peap: Continuing EAP-TLS
(17) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(17) eap_peap: Got complete TLS record (126 bytes)
(17) eap_peap: [eaptls verify] = length included
(17) eap_peap: <<< recv TLS 1.2  [length 0046]
(17) eap_peap: TLS_accept: SSLv3 read client key exchange A
(17) eap_peap: <<< recv TLS 1.2  [length 0001]
(17) eap_peap: <<< recv TLS 1.2  [length 0010]
(17) eap_peap: TLS_accept: SSLv3 read finished A
(17) eap_peap: >>> send TLS 1.2  [length 0001]
(17) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(17) eap_peap: >>> send TLS 1.2  [length 0010]
(17) eap_peap: TLS_accept: SSLv3 write finished A
(17) eap_peap: TLS_accept: SSLv3 flush data
(17) eap_peap: (other): SSL negotiation finished successfully
(17) eap_peap: SSL Connection Established
(17) eap_peap: [eaptls process] = handled
(17) eap: Sending EAP Request (code 1) ID 13 length 57
(17) eap: EAP session adding &reply:State = 0xd24e2fefd643361e
(17)     [eap] = handled
(17)   } # authenticate = handled
(17) Using Post-Auth-Type Challenge
(17) # Executing group from file /etc/raddb/sites-enabled/default
(17)   Challenge { ... } # empty sub-section is ignored
(17) Sent Access-Challenge Id 90 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(17)   EAP-Message =
0x010d00391900140303000101160303002843321548245ec01dba73ed278faccef9f8d84f6a91ba22e29ed32d8fa52b655a1961fed4437fbe96
(17)   Message-Authenticator = 0x00000000000000000000000000000000
(17)   State = 0xd24e2fefd643361eca7551413078c7bf
(17) Finished request
Waking up in 4.8 seconds.
(18) Received Access-Request Id 91 from 192.168.99.2:56766 to
192.168.99.13:1812 length 185
(18)   User-Name = "SEDLMEIER\\iah"
(18)   Service-Type = Framed-User
(18)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(18)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(18)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(18)   NAS-Port = 5
(18)   NAS-Port-Id = "fe.1.5"
(18)   Framed-MTU = 1500
(18)   NAS-Port-Type = Ethernet
(18)   State = 0xd24e2fefd643361eca7551413078c7bf
(18)   EAP-Message = 0x020d00061900
(18)   NAS-IP-Address = 0.0.0.0
(18)   Message-Authenticator = 0x35124549b88f9a323dd5076569fd6f8f
(18) session-state: No cached attributes
(18) # Executing section authorize from file /etc/raddb/sites-enabled/default
(18)   authorize {
(18)     policy filter_username {
(18)       if (&User-Name) {
(18)       if (&User-Name)  -> TRUE
(18)       if (&User-Name)  {
(18)         if (&User-Name =~ / /) {
(18)         if (&User-Name =~ / /)  -> FALSE
(18)         if (&User-Name =~ /@[^@]*@/ ) {
(18)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(18)         if (&User-Name =~ /\.\./ ) {
(18)         if (&User-Name =~ /\.\./ )  -> FALSE
(18)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(18)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(18)         if (&User-Name =~ /\.$/)  {
(18)         if (&User-Name =~ /\.$/)   -> FALSE
(18)         if (&User-Name =~ /@\./)  {
(18)         if (&User-Name =~ /@\./)   -> FALSE
(18)       } # if (&User-Name)  = notfound
(18)     } # policy filter_username = notfound
(18)     [preprocess] = ok
(18)     [chap] = noop
(18)     [mschap] = noop
(18)     [digest] = noop
(18) suffix: Checking for suffix after "@"
(18) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(18) suffix: No such realm "NULL"
(18)     [suffix] = noop
(18) ntdomain: Checking for prefix before "\"
(18) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(18) ntdomain: Found realm "SEDLMEIER"
(18) ntdomain: Adding Stripped-User-Name = "iah"
(18) ntdomain: Adding Realm = "SEDLMEIER"
(18) ntdomain: Authentication realm is LOCAL
(18)     [ntdomain] = ok
(18) eap: Peer sent EAP Response (code 2) ID 13 length 6
(18) eap: Continuing tunnel setup
(18)     [eap] = ok
(18)   } # authorize = ok
(18) Found Auth-Type = eap
(18) # Executing group from file /etc/raddb/sites-enabled/default
(18)   authenticate {
(18) eap: Expiring EAP session with state 0x5c12086c581511e3
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! EAP session with state 0x5c12086c581511e3 did not finish!                  !!
!! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility     !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(18) eap: Expiring EAP session with state 0xd24e2fefd643361e
(18) eap: Finished EAP session with state 0xd24e2fefd643361e
(18) eap: Previous EAP request found for state 0xd24e2fefd643361e,
released from the list
(18) eap: Peer sent packet with method EAP PEAP (25)
(18) eap: Calling submodule eap_peap to process data
(18) eap_peap: Continuing EAP-TLS
(18) eap_peap: Peer ACKed our handshake fragment.  handshake is finished
(18) eap_peap: [eaptls verify] = success
(18) eap_peap: [eaptls process] = success
(18) eap_peap: Session established.  Decoding tunneled attributes
(18) eap_peap: PEAP state TUNNEL ESTABLISHED
(18) eap: Sending EAP Request (code 1) ID 14 length 40
(18) eap: EAP session adding &reply:State = 0xd24e2fefd740361e
(18)     [eap] = handled
(18)   } # authenticate = handled
(18) Using Post-Auth-Type Challenge
(18) # Executing group from file /etc/raddb/sites-enabled/default
(18)   Challenge { ... } # empty sub-section is ignored
(18) Sent Access-Challenge Id 91 from 192.168.99.13:1812 to
192.168.99.2:56766 length 0
(18)   EAP-Message =
0x010e00281900170303001d43321548245ec01e88708f1dd4574539af080bc7be566d374a7cdc5bcf
(18)   Message-Authenticator = 0x00000000000000000000000000000000
(18)   State = 0xd24e2fefd740361eca7551413078c7bf
(18) Finished request
Waking up in 1.1 seconds.
(19) Received Access-Request Id 92 from 192.168.99.2:56766 to
192.168.99.13:1812 length 228
(19)   User-Name = "SEDLMEIER\\iah"
(19)   Service-Type = Framed-User
(19)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(19)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(19)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(19)   NAS-Port = 5
(19)   NAS-Port-Id = "fe.1.5"
(19)   Framed-MTU = 1500
(19)   NAS-Port-Type = Ethernet
(19)   State = 0xd24e2fefd740361eca7551413078c7bf
(19)   EAP-Message =
0x020e00311900170303002600000000000000014c60e795d3fff33be1fe23d361a3ffdd260b0c9848c8ab9a79295107f35c
(19)   NAS-IP-Address = 0.0.0.0
(19)   Message-Authenticator = 0xf15bf8bf58a9bddd9cb9d5bcd7258a75
(19) session-state: No cached attributes
(19) # Executing section authorize from file /etc/raddb/sites-enabled/default
(19)   authorize {
(19)     policy filter_username {
(19)       if (&User-Name) {
(19)       if (&User-Name)  -> TRUE
(19)       if (&User-Name)  {
(19)         if (&User-Name =~ / /) {
(19)         if (&User-Name =~ / /)  -> FALSE
(19)         if (&User-Name =~ /@[^@]*@/ ) {
(19)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(19)         if (&User-Name =~ /\.\./ ) {
(19)         if (&User-Name =~ /\.\./ )  -> FALSE
(19)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(19)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(19)         if (&User-Name =~ /\.$/)  {
(19)         if (&User-Name =~ /\.$/)   -> FALSE
(19)         if (&User-Name =~ /@\./)  {
(19)         if (&User-Name =~ /@\./)   -> FALSE
(19)       } # if (&User-Name)  = notfound
(19)     } # policy filter_username = notfound
(19)     [preprocess] = ok
(19)     [chap] = noop
(19)     [mschap] = noop
(19)     [digest] = noop
(19) suffix: Checking for suffix after "@"
(19) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(19) suffix: No such realm "NULL"
(19)     [suffix] = noop
(19) ntdomain: Checking for prefix before "\"
(19) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(19) ntdomain: Found realm "SEDLMEIER"
(19) ntdomain: Adding Stripped-User-Name = "iah"
(19) ntdomain: Adding Realm = "SEDLMEIER"
(19) ntdomain: Authentication realm is LOCAL
(19)     [ntdomain] = ok
(19) eap: Peer sent EAP Response (code 2) ID 14 length 49
(19) eap: Continuing tunnel setup
(19)     [eap] = ok
(19)   } # authorize = ok
(19) Found Auth-Type = eap
(19) # Executing group from file /etc/raddb/sites-enabled/default
(19)   authenticate {
(19) eap: Expiring EAP session with state 0xd24e2fefd740361e
(19) eap: Finished EAP session with state 0xd24e2fefd740361e
(19) eap: Previous EAP request found for state 0xd24e2fefd740361e,
released from the list
(19) eap: Peer sent packet with method EAP PEAP (25)
(19) eap: Calling submodule eap_peap to process data
(19) eap_peap: Continuing EAP-TLS
(19) eap_peap: [eaptls verify] = ok
(19) eap_peap: Done initial handshake
(19) eap_peap: [eaptls process] = ok
(19) eap_peap: Session established.  Decoding tunneled attributes
(19) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(19) eap_peap: Identity - SEDLMEIER\iah
(19) eap_peap: Got inner identity 'SEDLMEIER\iah'
(19) eap_peap: Setting default EAP type for tunneled EAP session
(19) eap_peap: Got tunneled request
(19) eap_peap:   EAP-Message = 0x020e0012015345444c4d454945525c696168
(19) eap_peap: Setting User-Name to SEDLMEIER\iah
(19) eap_peap: Sending tunneled request to inner-tunnel
(19) eap_peap:   EAP-Message = 0x020e0012015345444c4d454945525c696168
(19) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(19) eap_peap:   User-Name = "SEDLMEIER\\iah"
(19) Virtual server inner-tunnel received request
(19)   EAP-Message = 0x020e0012015345444c4d454945525c696168
(19)   FreeRADIUS-Proxied-To = 127.0.0.1
(19)   User-Name = "SEDLMEIER\\iah"
(19) WARNING: Outer and inner identities are the same.  User privacy
is compromised.
(19) server inner-tunnel {
(19)   # Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
(19)     authorize {
(19)       policy filter_username {
(19)         if (&User-Name) {
(19)         if (&User-Name)  -> TRUE
(19)         if (&User-Name)  {
(19)           if (&User-Name =~ / /) {
(19)           if (&User-Name =~ / /)  -> FALSE
(19)           if (&User-Name =~ /@[^@]*@/ ) {
(19)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(19)           if (&User-Name =~ /\.\./ ) {
(19)           if (&User-Name =~ /\.\./ )  -> FALSE
(19)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(19)           if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(19)           if (&User-Name =~ /\.$/)  {
(19)           if (&User-Name =~ /\.$/)   -> FALSE
(19)           if (&User-Name =~ /@\./)  {
(19)           if (&User-Name =~ /@\./)   -> FALSE
(19)         } # if (&User-Name)  = notfound
(19)       } # policy filter_username = notfound
(19)       [chap] = noop
(19)       [mschap] = noop
(19) suffix: Checking for suffix after "@"
(19) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(19) suffix: No such realm "NULL"
(19)       [suffix] = noop
(19)       update control {
(19)         &Proxy-To-Realm := LOCAL
(19)       } # update control = noop
(19) eap: Peer sent EAP Response (code 2) ID 14 length 18
(19) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(19)       [eap] = ok
(19)     } # authorize = ok
(19)   Found Auth-Type = eap
(19)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(19)     authenticate {
(19) eap: Peer sent packet with method EAP Identity (1)
(19) eap: Calling submodule eap_mschapv2 to process data
(19) eap_mschapv2: Issuing Challenge
(19) eap: Sending EAP Request (code 1) ID 15 length 43
(19) eap: EAP session adding &reply:State = 0xd63550fbd63a4a59
(19)       [eap] = handled
(19)     } # authenticate = handled
(19) } # server inner-tunnel
(19) Virtual server sending reply
(19)   EAP-Message =
0x010f002b1a010f002610cdb5ec45cd7c8807ca51f4db0a9a0f8e667265657261646975732d332e302e3135
(19)   Message-Authenticator = 0x00000000000000000000000000000000
(19)   State = 0xd63550fbd63a4a59a7b76b3185c969aa
(19) eap_peap: Got tunneled reply code 11
(19) eap_peap:   EAP-Message =
0x010f002b1a010f002610cdb5ec45cd7c8807ca51f4db0a9a0f8e667265657261646975732d332e302e3135
(19) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(19) eap_peap:   State = 0xd63550fbd63a4a59a7b76b3185c969aa
(19) eap_peap: Got tunneled reply RADIUS code 11
(19) eap_peap:   EAP-Message =
0x010f002b1a010f002610cdb5ec45cd7c8807ca51f4db0a9a0f8e667265657261646975732d332e302e3135
(19) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(19) eap_peap:   State = 0xd63550fbd63a4a59a7b76b3185c969aa
(19) eap_peap: Got tunneled Access-Challenge
(19) eap: Sending EAP Request (code 1) ID 15 length 74
(19) eap: EAP session adding &reply:State = 0xd24e2fefd441361e
(19)     [eap] = handled
(19)   } # authenticate = handled
(19) Using Post-Auth-Type Challenge
(19) # Executing group from file /etc/raddb/sites-enabled/default
(19)   Challenge { ... } # empty sub-section is ignored
(19) Sent Access-Challenge Id 92 from 192.168.99.13:1812 to
192.168.99.2:56766 length 0
(19)   EAP-Message =
0x010f004a1900170303003f43321548245ec01fd8d4b27cca3a84abb84109983ba36bcbb5f93f5107a6d42a8784d3e3a77558274dc11880a5f3da779aa89051dcb25dd6ab1c86923b3cbb
(19)   Message-Authenticator = 0x00000000000000000000000000000000
(19)   State = 0xd24e2fefd441361eca7551413078c7bf
(19) Finished request
Waking up in 0.8 seconds.
(20) Received Access-Request Id 93 from 192.168.99.2:56766 to
192.168.99.13:1812 length 282
(20)   User-Name = "SEDLMEIER\\iah"
(20)   Service-Type = Framed-User
(20)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(20)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(20)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(20)   NAS-Port = 5
(20)   NAS-Port-Id = "fe.1.5"
(20)   Framed-MTU = 1500
(20)   NAS-Port-Type = Ethernet
(20)   State = 0xd24e2fefd441361eca7551413078c7bf
(20)   EAP-Message =
0x020f00671900170303005c000000000000000243241aa425d6f7c8d71509c3b60a4c6b8db4cad3d64eef888d40802d40c2c86b4500c9bb1901556e079452b3643718c88cdb7fe0a50aa320e9d9c7f849290f380b06d9730e79d4e4c2be3e04b14c604a00ccbdd2
(20)   NAS-IP-Address = 0.0.0.0
(20)   Message-Authenticator = 0xa846eca9d309e94652e1c58fbaa05dce
(20) session-state: No cached attributes
(20) # Executing section authorize from file /etc/raddb/sites-enabled/default
(20)   authorize {
(20)     policy filter_username {
(20)       if (&User-Name) {
(20)       if (&User-Name)  -> TRUE
(20)       if (&User-Name)  {
(20)         if (&User-Name =~ / /) {
(20)         if (&User-Name =~ / /)  -> FALSE
(20)         if (&User-Name =~ /@[^@]*@/ ) {
(20)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(20)         if (&User-Name =~ /\.\./ ) {
(20)         if (&User-Name =~ /\.\./ )  -> FALSE
(20)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(20)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(20)         if (&User-Name =~ /\.$/)  {
(20)         if (&User-Name =~ /\.$/)   -> FALSE
(20)         if (&User-Name =~ /@\./)  {
(20)         if (&User-Name =~ /@\./)   -> FALSE
(20)       } # if (&User-Name)  = notfound
(20)     } # policy filter_username = notfound
(20)     [preprocess] = ok
(20)     [chap] = noop
(20)     [mschap] = noop
(20)     [digest] = noop
(20) suffix: Checking for suffix after "@"
(20) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(20) suffix: No such realm "NULL"
(20)     [suffix] = noop
(20) ntdomain: Checking for prefix before "\"
(20) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(20) ntdomain: Found realm "SEDLMEIER"
(20) ntdomain: Adding Stripped-User-Name = "iah"
(20) ntdomain: Adding Realm = "SEDLMEIER"
(20) ntdomain: Authentication realm is LOCAL
(20)     [ntdomain] = ok
(20) eap: Peer sent EAP Response (code 2) ID 15 length 103
(20) eap: Continuing tunnel setup
(20)     [eap] = ok
(20)   } # authorize = ok
(20) Found Auth-Type = eap
(20) # Executing group from file /etc/raddb/sites-enabled/default
(20)   authenticate {
(20) eap: Expiring EAP session with state 0xd63550fbd63a4a59
(20) eap: Finished EAP session with state 0xd24e2fefd441361e
(20) eap: Previous EAP request found for state 0xd24e2fefd441361e,
released from the list
(20) eap: Peer sent packet with method EAP PEAP (25)
(20) eap: Calling submodule eap_peap to process data
(20) eap_peap: Continuing EAP-TLS
(20) eap_peap: [eaptls verify] = ok
(20) eap_peap: Done initial handshake
(20) eap_peap: [eaptls process] = ok
(20) eap_peap: Session established.  Decoding tunneled attributes
(20) eap_peap: PEAP state phase2
(20) eap_peap: EAP method MSCHAPv2 (26)
(20) eap_peap: Got tunneled request
(20) eap_peap:   EAP-Message =
0x020f00481a020f0043312af06a1435a1a34bfca5dc612d69a1d10000000000000000aee7c918d346a026e864b8344642b61250828f7f16106ae4005345444c4d454945525c696168
(20) eap_peap: Setting User-Name to SEDLMEIER\iah
(20) eap_peap: Sending tunneled request to inner-tunnel
(20) eap_peap:   EAP-Message =
0x020f00481a020f0043312af06a1435a1a34bfca5dc612d69a1d10000000000000000aee7c918d346a026e864b8344642b61250828f7f16106ae4005345444c4d454945525c696168
(20) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(20) eap_peap:   User-Name = "SEDLMEIER\\iah"
(20) eap_peap:   State = 0xd63550fbd63a4a59a7b76b3185c969aa
(20) Virtual server inner-tunnel received request
(20)   EAP-Message =
0x020f00481a020f0043312af06a1435a1a34bfca5dc612d69a1d10000000000000000aee7c918d346a026e864b8344642b61250828f7f16106ae4005345444c4d454945525c696168
(20)   FreeRADIUS-Proxied-To = 127.0.0.1
(20)   User-Name = "SEDLMEIER\\iah"
(20)   State = 0xd63550fbd63a4a59a7b76b3185c969aa
(20) WARNING: Outer and inner identities are the same.  User privacy
is compromised.
(20) server inner-tunnel {
(20)   session-state: No cached attributes
(20)   # Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
(20)     authorize {
(20)       policy filter_username {
(20)         if (&User-Name) {
(20)         if (&User-Name)  -> TRUE
(20)         if (&User-Name)  {
(20)           if (&User-Name =~ / /) {
(20)           if (&User-Name =~ / /)  -> FALSE
(20)           if (&User-Name =~ /@[^@]*@/ ) {
(20)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(20)           if (&User-Name =~ /\.\./ ) {
(20)           if (&User-Name =~ /\.\./ )  -> FALSE
(20)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(20)           if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(20)           if (&User-Name =~ /\.$/)  {
(20)           if (&User-Name =~ /\.$/)   -> FALSE
(20)           if (&User-Name =~ /@\./)  {
(20)           if (&User-Name =~ /@\./)   -> FALSE
(20)         } # if (&User-Name)  = notfound
(20)       } # policy filter_username = notfound
(20)       [chap] = noop
(20)       [mschap] = noop
(20) suffix: Checking for suffix after "@"
(20) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(20) suffix: No such realm "NULL"
(20)       [suffix] = noop
(20)       update control {
(20)         &Proxy-To-Realm := LOCAL
(20)       } # update control = noop
(20) eap: Peer sent EAP Response (code 2) ID 15 length 72
(20) eap: No EAP Start, assuming it's an on-going EAP conversation
(20)       [eap] = updated
(20) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Closing connection (5): Hit idle_timeout, was idle
for 61 seconds
rlm_ldap (ldap): Reserved connection (0)
(20) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(20) files:    --> (samaccountname=SEDLMEIER\5c5ciah)
(20) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=SEDLMEIER\5c5ciah)", scope "sub"
(20) files: Waiting for search result...
(20) files: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 7 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (8), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(20) files: users: Matched entry DEFAULT at line 48
(20)       [files] = ok
rlm_ldap (ldap): Reserved connection (7)
(20) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(20) ldap:    --> (samaccountname=SEDLMEIER\5c5ciah)
(20) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=SEDLMEIER\5c5ciah)", scope "sub"
(20) ldap: Waiting for search result...
(20) ldap: Search returned no results
rlm_ldap (ldap): Released connection (7)
(20)       [ldap] = notfound
(20)       [expiration] = noop
(20)       [logintime] = noop
(20) pap: WARNING: Auth-Type already set.  Not setting to PAP
(20)       [pap] = noop
(20)     } # authorize = updated
(20)   Found Auth-Type = Reject
(20)   Auth-Type = Reject, rejecting user
(20)   Failed to authenticate the user
(20)   Using Post-Auth-Type Reject
(20)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(20)     Post-Auth-Type REJECT {
(20) attr_filter.access_reject: EXPAND %{User-Name}
(20) attr_filter.access_reject:    --> SEDLMEIER\\iah
(20) attr_filter.access_reject: Matched entry DEFAULT at line 11
(20)       [attr_filter.access_reject] = updated
(20)       update outer.session-state {
(20)         No attributes updated
(20)       } # update outer.session-state = noop
(20)     } # Post-Auth-Type REJECT = updated
(20) } # server inner-tunnel
(20) Virtual server sending reply
(20) eap_peap: Got tunneled reply code 3
(20) eap_peap: Got tunneled reply RADIUS code 3
(20) eap_peap: Tunneled authentication was rejected
(20) eap_peap: FAILURE
(20) eap: Sending EAP Request (code 1) ID 16 length 46
(20) eap: EAP session adding &reply:State = 0xd24e2fefd55e361e
(20)     [eap] = handled
(20)   } # authenticate = handled
(20) Using Post-Auth-Type Challenge
(20) # Executing group from file /etc/raddb/sites-enabled/default
(20)   Challenge { ... } # empty sub-section is ignored
(20) Sent Access-Challenge Id 93 from 192.168.99.13:1812 to
192.168.99.2:56766 length 0
(20)   EAP-Message =
0x0110002e1900170303002343321548245ec020494ccfac9bdaeb65e6d6b730b817ad0e5a713d9147d8907ee86758
(20)   Message-Authenticator = 0x00000000000000000000000000000000
(20)   State = 0xd24e2fefd55e361eca7551413078c7bf
(20) Finished request
Waking up in 0.8 seconds.
(21) Received Access-Request Id 94 from 192.168.99.2:56766 to
192.168.99.13:1812 length 225
(21)   User-Name = "SEDLMEIER\\iah"
(21)   Service-Type = Framed-User
(21)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(21)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(21)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(21)   NAS-Port = 5
(21)   NAS-Port-Id = "fe.1.5"
(21)   Framed-MTU = 1500
(21)   NAS-Port-Type = Ethernet
(21)   State = 0xd24e2fefd55e361eca7551413078c7bf
(21)   EAP-Message =
0x0210002e190017030300230000000000000003fd9a2119383e53ff7d00f1f74abce68623121647bbdf04f935dd79
(21)   NAS-IP-Address = 0.0.0.0
(21)   Message-Authenticator = 0xa80f722db31b729f2e934bd07c37b528
(21) session-state: No cached attributes
(21) # Executing section authorize from file /etc/raddb/sites-enabled/default
(21)   authorize {
(21)     policy filter_username {
(21)       if (&User-Name) {
(21)       if (&User-Name)  -> TRUE
(21)       if (&User-Name)  {
(21)         if (&User-Name =~ / /) {
(21)         if (&User-Name =~ / /)  -> FALSE
(21)         if (&User-Name =~ /@[^@]*@/ ) {
(21)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(21)         if (&User-Name =~ /\.\./ ) {
(21)         if (&User-Name =~ /\.\./ )  -> FALSE
(21)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(21)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(21)         if (&User-Name =~ /\.$/)  {
(21)         if (&User-Name =~ /\.$/)   -> FALSE
(21)         if (&User-Name =~ /@\./)  {
(21)         if (&User-Name =~ /@\./)   -> FALSE
(21)       } # if (&User-Name)  = notfound
(21)     } # policy filter_username = notfound
(21)     [preprocess] = ok
(21)     [chap] = noop
(21)     [mschap] = noop
(21)     [digest] = noop
(21) suffix: Checking for suffix after "@"
(21) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(21) suffix: No such realm "NULL"
(21)     [suffix] = noop
(21) ntdomain: Checking for prefix before "\"
(21) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(21) ntdomain: Found realm "SEDLMEIER"
(21) ntdomain: Adding Stripped-User-Name = "iah"
(21) ntdomain: Adding Realm = "SEDLMEIER"
(21) ntdomain: Authentication realm is LOCAL
(21)     [ntdomain] = ok
(21) eap: Peer sent EAP Response (code 2) ID 16 length 46
(21) eap: Continuing tunnel setup
(21)     [eap] = ok
(21)   } # authorize = ok
(21) Found Auth-Type = eap
(21) # Executing group from file /etc/raddb/sites-enabled/default
(21)   authenticate {
(21) eap: Expiring EAP session with state 0xd63550fbd63a4a59
(21) eap: Finished EAP session with state 0xd24e2fefd55e361e
(21) eap: Previous EAP request found for state 0xd24e2fefd55e361e,
released from the list
(21) eap: Peer sent packet with method EAP PEAP (25)
(21) eap: Calling submodule eap_peap to process data
(21) eap_peap: Continuing EAP-TLS
(21) eap_peap: [eaptls verify] = ok
(21) eap_peap: Done initial handshake
(21) eap_peap: [eaptls process] = ok
(21) eap_peap: Session established.  Decoding tunneled attributes
(21) eap_peap: PEAP state send tlv failure
(21) eap_peap: Received EAP-TLV response
(21) eap_peap:   ERROR: The users session was previously rejected:
returning reject (again.)
(21) eap_peap:   This means you need to read the PREVIOUS messages in
the debug output
(21) eap_peap:   to find out the reason why the user was rejected
(21) eap_peap:   Look for "reject" or "fail".  Those earlier messages
will tell you
(21) eap_peap:   what went wrong, and how to fix the problem
(21) eap: ERROR: Failed continuing EAP PEAP (25) session.  EAP sub-module failed
(21) eap: Sending EAP Failure (code 4) ID 16 length 4
(21) eap: Failed in EAP select
(21)     [eap] = invalid
(21)   } # authenticate = invalid
(21) Failed to authenticate the user
(21) Using Post-Auth-Type Reject
(21) # Executing group from file /etc/raddb/sites-enabled/default
(21)   Post-Auth-Type REJECT {
(21) attr_filter.access_reject: EXPAND %{User-Name}
(21) attr_filter.access_reject:    --> SEDLMEIER\\iah
(21) attr_filter.access_reject: Matched entry DEFAULT at line 11
(21)     [attr_filter.access_reject] = updated
(21)     [eap] = noop
(21)     policy remove_reply_message_if_eap {
(21)       if (&reply:EAP-Message && &reply:Reply-Message) {
(21)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(21)       else {
(21)         [noop] = noop
(21)       } # else = noop
(21)     } # policy remove_reply_message_if_eap = noop
(21)   } # Post-Auth-Type REJECT = updated
(21) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.5 seconds.
(13) Cleaning up request packet ID 86 with timestamp +120
(14) Cleaning up request packet ID 87 with timestamp +120
(15) Cleaning up request packet ID 88 with timestamp +120
(16) Cleaning up request packet ID 89 with timestamp +120
(17) Cleaning up request packet ID 90 with timestamp +120
(21) Sending delayed response
(21) Sent Access-Reject Id 94 from 192.168.99.13:1812 to
192.168.99.2:56766 length 44
(21)   EAP-Message = 0x04100004
(21)   Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.7 seconds.
(22) Received Access-Request Id 95 from 192.168.99.2:56767 to
192.168.99.13:1812 length 175
(22)   User-Name = "74-2B-62-85-F5-5D"
(22)   Service-Type = Framed-User
(22)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(22)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(22)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(22)   NAS-Port = 5
(22)   NAS-Port-Type = Ethernet
(22)   NAS-Port-Id = "fe.1.5"
(22)   NAS-IP-Address = 0.0.0.0
(22)   User-Password = "NOPASSWORD"
(22)   Message-Authenticator = 0x021b111bb35ea99580a18323fb64c271
(22) # Executing section authorize from file /etc/raddb/sites-enabled/default
(22)   authorize {
(22)     policy filter_username {
(22)       if (&User-Name) {
(22)       if (&User-Name)  -> TRUE
(22)       if (&User-Name)  {
(22)         if (&User-Name =~ / /) {
(22)         if (&User-Name =~ / /)  -> FALSE
(22)         if (&User-Name =~ /@[^@]*@/ ) {
(22)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(22)         if (&User-Name =~ /\.\./ ) {
(22)         if (&User-Name =~ /\.\./ )  -> FALSE
(22)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(22)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(22)         if (&User-Name =~ /\.$/)  {
(22)         if (&User-Name =~ /\.$/)   -> FALSE
(22)         if (&User-Name =~ /@\./)  {
(22)         if (&User-Name =~ /@\./)   -> FALSE
(22)       } # if (&User-Name)  = notfound
(22)     } # policy filter_username = notfound
(22)     [preprocess] = ok
(22)     [chap] = noop
(22)     [mschap] = noop
(22)     [digest] = noop
(22) suffix: Checking for suffix after "@"
(22) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(22) suffix: No such realm "NULL"
(22)     [suffix] = noop
(22) ntdomain: Checking for prefix before "\"
(22) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(22) ntdomain: No such realm "NULL"
(22)     [ntdomain] = noop
(22) eap: No EAP-Message, not doing EAP
(22)     [eap] = noop
(22) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Reserved connection (6)
(22) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(22) files:    --> (samaccountname=74-2B-62-85-F5-5D)
(22) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(22) files: Waiting for search result...
(22) files: Search returned no results
rlm_ldap (ldap): Released connection (6)
Need 6 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (9), 1 of 28 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(22) files: users: Matched entry DEFAULT at line 48
(22)     [files] = ok
rlm_ldap (ldap): Reserved connection (0)
(22) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(22) ldap:    --> (samaccountname=74-2B-62-85-F5-5D)
(22) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(22) ldap: Waiting for search result...
(22) ldap: Search returned no results
rlm_ldap (ldap): Released connection (0)
(22)     [ldap] = notfound
(22)     [expiration] = noop
(22)     [logintime] = noop
(22) pap: WARNING: Auth-Type already set.  Not setting to PAP
(22)     [pap] = noop
(22)   } # authorize = ok
(22) Found Auth-Type = Reject
(22) Auth-Type = Reject, rejecting user
(22) Failed to authenticate the user
(22) Using Post-Auth-Type Reject
(22) # Executing group from file /etc/raddb/sites-enabled/default
(22)   Post-Auth-Type REJECT {
(22) attr_filter.access_reject: EXPAND %{User-Name}
(22) attr_filter.access_reject:    --> 74-2B-62-85-F5-5D
(22) attr_filter.access_reject: Matched entry DEFAULT at line 11
(22)     [attr_filter.access_reject] = updated
(22)     [eap] = noop
(22)     policy remove_reply_message_if_eap {
(22)       if (&reply:EAP-Message && &reply:Reply-Message) {
(22)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(22)       else {
(22)         [noop] = noop
(22)       } # else = noop
(22)     } # policy remove_reply_message_if_eap = noop
(22)   } # Post-Auth-Type REJECT = updated
(22) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(22) Sending delayed response
(22) Sent Access-Reject Id 95 from 192.168.99.13:1812 to
192.168.99.2:56767 length 20
Waking up in 1.4 seconds.
(18) Cleaning up request packet ID 91 with timestamp +124
Waking up in 0.2 seconds.
(19) Cleaning up request packet ID 92 with timestamp +124
(20) Cleaning up request packet ID 93 with timestamp +124
(21) Cleaning up request packet ID 94 with timestamp +124
Waking up in 2.2 seconds.
(22) Cleaning up request packet ID 95 with timestamp +127
Ready to process requests
(23) Received Access-Request Id 96 from 192.168.99.2:56768 to
192.168.99.13:1812 length 175
(23)   User-Name = "74-2B-62-85-F5-5D"
(23)   Service-Type = Framed-User
(23)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(23)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(23)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(23)   NAS-Port = 5
(23)   NAS-Port-Type = Ethernet
(23)   NAS-Port-Id = "fe.1.5"
(23)   NAS-IP-Address = 0.0.0.0
(23)   User-Password = "NOPASSWORD"
(23)   Message-Authenticator = 0x61a938694f2b1d475b794be1a7b3ebe3
(23) # Executing section authorize from file /etc/raddb/sites-enabled/default
(23)   authorize {
(23)     policy filter_username {
(23)       if (&User-Name) {
(23)       if (&User-Name)  -> TRUE
(23)       if (&User-Name)  {
(23)         if (&User-Name =~ / /) {
(23)         if (&User-Name =~ / /)  -> FALSE
(23)         if (&User-Name =~ /@[^@]*@/ ) {
(23)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(23)         if (&User-Name =~ /\.\./ ) {
(23)         if (&User-Name =~ /\.\./ )  -> FALSE
(23)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(23)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(23)         if (&User-Name =~ /\.$/)  {
(23)         if (&User-Name =~ /\.$/)   -> FALSE
(23)         if (&User-Name =~ /@\./)  {
(23)         if (&User-Name =~ /@\./)   -> FALSE
(23)       } # if (&User-Name)  = notfound
(23)     } # policy filter_username = notfound
(23)     [preprocess] = ok
(23)     [chap] = noop
(23)     [mschap] = noop
(23)     [digest] = noop
(23) suffix: Checking for suffix after "@"
(23) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(23) suffix: No such realm "NULL"
(23)     [suffix] = noop
(23) ntdomain: Checking for prefix before "\"
(23) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(23) ntdomain: No such realm "NULL"
(23)     [ntdomain] = noop
(23) eap: No EAP-Message, not doing EAP
(23)     [eap] = noop
(23) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Reserved connection (8)
(23) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(23) files:    --> (samaccountname=74-2B-62-85-F5-5D)
(23) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(23) files: Waiting for search result...
(23) files: Search returned no results
rlm_ldap (ldap): Released connection (8)
Need 5 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (10), 1 of 27 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(23) files: users: Matched entry DEFAULT at line 48
(23)     [files] = ok
rlm_ldap (ldap): Reserved connection (7)
(23) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(23) ldap:    --> (samaccountname=74-2B-62-85-F5-5D)
(23) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(23) ldap: Waiting for search result...
(23) ldap: Search returned no results
rlm_ldap (ldap): Released connection (7)
(23)     [ldap] = notfound
(23)     [expiration] = noop
(23)     [logintime] = noop
(23) pap: WARNING: Auth-Type already set.  Not setting to PAP
(23)     [pap] = noop
(23)   } # authorize = ok
(23) Found Auth-Type = Reject
(23) Auth-Type = Reject, rejecting user
(23) Failed to authenticate the user
(23) Using Post-Auth-Type Reject
(23) # Executing group from file /etc/raddb/sites-enabled/default
(23)   Post-Auth-Type REJECT {
(23) attr_filter.access_reject: EXPAND %{User-Name}
(23) attr_filter.access_reject:    --> 74-2B-62-85-F5-5D
(23) attr_filter.access_reject: Matched entry DEFAULT at line 11
(23)     [attr_filter.access_reject] = updated
(23)     [eap] = noop
(23)     policy remove_reply_message_if_eap {
(23)       if (&reply:EAP-Message && &reply:Reply-Message) {
(23)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(23)       else {
(23)         [noop] = noop
(23)       } # else = noop
(23)     } # policy remove_reply_message_if_eap = noop
(23)   } # Post-Auth-Type REJECT = updated
(23) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(23) Sending delayed response
(23) Sent Access-Reject Id 96 from 192.168.99.13:1812 to
192.168.99.2:56768 length 20
Waking up in 3.9 seconds.
(23) Cleaning up request packet ID 96 with timestamp +159
Ready to process requests
(24) Received Access-Request Id 97 from 192.168.99.2:56769 to
192.168.99.13:1812 length 175
(24)   User-Name = "74-2B-62-85-F5-5D"
(24)   Service-Type = Framed-User
(24)   Called-Station-Id = "D8-84-66-1C-A0-C2"
(24)   Calling-Station-Id = "74-2B-62-85-F5-5D"
(24)   NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(24)   NAS-Port = 5
(24)   NAS-Port-Type = Ethernet
(24)   NAS-Port-Id = "fe.1.5"
(24)   NAS-IP-Address = 0.0.0.0
(24)   User-Password = "NOPASSWORD"
(24)   Message-Authenticator = 0x9fd73ed0326f59255d14a3f48157518d
(24) # Executing section authorize from file /etc/raddb/sites-enabled/default
(24)   authorize {
(24)     policy filter_username {
(24)       if (&User-Name) {
(24)       if (&User-Name)  -> TRUE
(24)       if (&User-Name)  {
(24)         if (&User-Name =~ / /) {
(24)         if (&User-Name =~ / /)  -> FALSE
(24)         if (&User-Name =~ /@[^@]*@/ ) {
(24)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(24)         if (&User-Name =~ /\.\./ ) {
(24)         if (&User-Name =~ /\.\./ )  -> FALSE
(24)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(24)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(24)         if (&User-Name =~ /\.$/)  {
(24)         if (&User-Name =~ /\.$/)   -> FALSE
(24)         if (&User-Name =~ /@\./)  {
(24)         if (&User-Name =~ /@\./)   -> FALSE
(24)       } # if (&User-Name)  = notfound
(24)     } # policy filter_username = notfound
(24)     [preprocess] = ok
(24)     [chap] = noop
(24)     [mschap] = noop
(24)     [digest] = noop
(24) suffix: Checking for suffix after "@"
(24) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(24) suffix: No such realm "NULL"
(24)     [suffix] = noop
(24) ntdomain: Checking for prefix before "\"
(24) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(24) ntdomain: No such realm "NULL"
(24)     [ntdomain] = noop
(24) eap: No EAP-Message, not doing EAP
(24)     [eap] = noop
(24) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Closing connection (6): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Closing connection (9): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Reserved connection (8)
(24) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(24) files:    --> (samaccountname=74-2B-62-85-F5-5D)
(24) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(24) files: Waiting for search result...
(24) files: Search returned no results
rlm_ldap (ldap): Released connection (8)
Need 7 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (11), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(24) files: users: Matched entry DEFAULT at line 48
(24)     [files] = ok
rlm_ldap (ldap): Reserved connection (10)
(24) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(24) ldap:    --> (samaccountname=74-2B-62-85-F5-5D)
(24) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(24) ldap: Waiting for search result...
(24) ldap: Search returned no results
rlm_ldap (ldap): Released connection (10)
(24)     [ldap] = notfound
(24)     [expiration] = noop
(24)     [logintime] = noop
(24) pap: WARNING: Auth-Type already set.  Not setting to PAP
(24)     [pap] = noop
(24)   } # authorize = ok
(24) Found Auth-Type = Reject
(24) Auth-Type = Reject, rejecting user
(24) Failed to authenticate the user
(24) Using Post-Auth-Type Reject
(24) # Executing group from file /etc/raddb/sites-enabled/default
(24)   Post-Auth-Type REJECT {
(24) attr_filter.access_reject: EXPAND %{User-Name}
(24) attr_filter.access_reject:    --> 74-2B-62-85-F5-5D
(24) attr_filter.access_reject: Matched entry DEFAULT at line 11
(24)     [attr_filter.access_reject] = updated
(24)     [eap] = noop
(24)     policy remove_reply_message_if_eap {
(24)       if (&reply:EAP-Message && &reply:Reply-Message) {
(24)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(24)       else {
(24)         [noop] = noop
(24)       } # else = noop
(24)     } # policy remove_reply_message_if_eap = noop
(24)   } # Post-Auth-Type REJECT = updated
(24) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(24) Sending delayed response
(24) Sent Access-Reject Id 97 from 192.168.99.13:1812 to
192.168.99.2:56769 length 20
Waking up in 3.9 seconds.
(24) Cleaning up request packet ID 97 with timestamp +190
Ready to process requests

-----

Do you have any ideas about what it could be.
Thanks in advance.

I have a problem with the authorization by LDAP and Authentication with AD

I Aaaaaahhhhhh