In other words, if I proxy to the old radius server, the username needs to be realm\user again.
Set "nostrip" in the realm configuration.
I finally have a solution. I wanted to keep strip enabled because I have to perform the LDAP query on the stripped username. So, I added the following logic to pre-proxy {}: # non-migrated old child domain user if ("%{control:Proxy-To-Realm}" != "newrealm" && Realm) { update proxy-request { User-Name := "%{Stripped-User-Name}@%{Realm}" } } This allows me to authenticate all child domain users from a single old parent domain controller instead of having IAS servers installed in every child domain. I just had to re-read the unlang man page enough times to get all the pieces. Thanks for all your help! David