Two factor authentication

hi i am trying to configure freeradius to authenticate wireless users. i would like to use a two-factor authentication. - all pcs that want to connect to the wireless network need a certificate signed by CA - users must authenticate with their user/pass active directory i am not sure how to do it rasdius.conf authorize { eap } authenticate { Auth-Type MS-CHAP { mschap } } eap.conf tls { private_key_password = password private_key_file = /cert/cert-srv.pem CA_file = /CA/ca-cert.pem dh_file= /dev/urandom } best regards alfonso