Thanks it worked but with some workaround

group{
                        mschap{
                                reject =1
                                ok = return
                        }
                        if ( Module-Failure-Message =~ /.*winbind reply failed.*/i){
                                mschap_local
                        }       
                }       
}
with out adding group or mschap {} it was returning reject to parent and we were not seeing if condition etc,
with above config it works 

On Tue, Feb 26, 2013 at 5:35 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 26/02/13 10:18, Chitrang Srivastava wrote:
Thanks this may solve the issue but one doubt ,
 > if (Module-Failure-Message =~ /.*logon fail.*/i) {
How is Module-failure-Message is handled , I guess its a string ?

Yes. It is set by some/most modules, but in particular "mschap" sets it to the error output of ntlm_auth


What kind of comparision are you doing ?

The example above is a case-insensitive regexp. See "man unlang"

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html