Hi,
The order is this: supplicant (Mac or Windows) >> FreeRadius (via EAP and PEAP or EAP and MSCHAP) >> FreeIPA ldap server (389DS)
If there is no MSCHAP hash (or cleartext PW) in your LDAP backend, there will be no way to make this work. The "bob" example works because FR has the cleartext PW ready and can do MSCHAP by itsself. The "farhadtest" example does not because the backend neither has an MSCHAP hash nor a cleartext PW, just a good (i.e. non-reversible) hash of the PW. But you could make your Windows clients use EAP/TTLS-PAP instead of PEAP/MSCHAPv2, this _should_ work. Cheers, Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly@HRZ.Uni-Marburg.DE D-35032 Marburg