rad_recv: Access-Request packet from host 127.0.0.1 port 60112, id=208, length=68
    User-Name = "XXX@domain.es"
    User-Password = "YYY"
    NAS-IP-Address = 127.0.1.1
    NAS-Port = 0
+- entering group authorize
++[preprocess] returns ok
++[mschap] returns noop
    rlm_realm: Looking up realm "domain.es" for User-Name = "XXX@domain.es"
    rlm_realm: Found realm "~(domain)+"
    rlm_realm: Adding Stripped-User-Name = "XXX"
    rlm_realm: Adding Realm = "~(domain)+"
    rlm_realm: Authentication realm is LOCAL.
++[suffix] returns noop
rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
++? if ("%{Realm}" =~ /(temp\.)?domain\.es$/)
    expand: %{Realm} -> ~(domain)+
? Evaluating ("%{Realm}" =~ /(temp\.)?domain\.es$/) -> FALSE
++? if ("%{Realm}" =~ /(temp\.)?domain\.es$/) -> FALSE
++[files] returns noop
    expand: %{Realm} -> ~(domain)+
++- entering switch %{Realm}
+++- entering case
++++[control] returns noop
+++- case returns noop
++- switch %{Realm} returns noop

I can resolve this adding this to proxy.conf:

### /etc/freeradius/proxy.conf

realm "domain.es" {
      authhost = LOCAL      # not strictly necessary
      accthost = LOCAL      # not strictly necessary
}

realm "temp.domain.es" {
      authhost = LOCAL      # not strictly necessary
      accthost = LOCAL      # not strictly necessary
}

realm "~(domain)+" {
      authhost = LOCAL      # not strictly necessary
      accthost = LOCAL      # not strictly necessary
}

But I don't know if that is the best way to resolve my problem, so I would like to reinforce my decision.

Thanks in advance and sorry for my english.

--
____________________

Ana Gallardo Gómez
____________________