Hi, I'm working on upgrading from FR 1.1.7 to FR 2.1.3. I use FR for EAP-TTLS/PAP authentication with LDAP. FR 1.1.7 successfully authenticates users with multiple LDAPuserpassword attributes which are stored with crypt and/or MD5 hash, the passwords are not the same (even it's better if the are) : ####################################################################### [...] rlm_ldap: performing user authorization for mylogin radius_xlat: '(&(uid=mylogin)(udsradiusProfileWifi=*))' radius_xlat: 'ou=people,o=annuaire' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,o=annuaire, with filter (&(uid=mylogin)(udsradiusProfileWifi=*)) rlm_ldap: performing search in uid=wifi-crc,ou=profilsWifi,o=annuaire, with filter (objectclass=radiusprofile) rlm_ldap: Added password {MD5}xxxxx in check items rlm_ldap: Added password {crypt}xxxxx in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user mylogin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "LDAP_OSIRIS" returns ok for request 29 modcall: leaving group LDAP_OSIRIS (returns ok) for request 29 rad_check_password: Found Auth-Type LDAP_OSIRIS auth: type "LDAP_OSIRIS" Processing the authenticate section of radiusd.conf modcall: entering group LDAP_OSIRIS for request 29 rlm_ldap: - authenticate rlm_ldap: login attempt by "saillard" with password "mycleartextpassword" rlm_ldap: user DN: uid=mylogin,ou=uds,ou=people,o=annuaire rlm_ldap: (re)connect to ldaps://ldapuds.u-strasbg.fr, authentication 1 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as uid=mylogin,ou=uds,ou=people,o=annuaire/polopackvih+ to ldaps://ldapuds.u-strasbg.fr rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user mylogin authenticated succesfully [...] ####################################################################### Now with FR 2.1.3, it looks like only the first password attribute is used : ####################################################################### [...] [ldap] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(udsradiusProfileWifi=*)) -> (&(uid=mylogin)(udsradiusProfileWifi=*)) [ldap] expand: ou=people,o=annuaire -> ou=people,o=annuaire rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,o=annuaire, with filter (&(uid=mylogin)(udsradiusProfileWifi=*)) rlm_ldap: performing search in uid=wifi-crc,ou=profilsWifi,o=annuaire, with filter (objectclass=radiusprofile) [ldap] Added User-Password = {crypt}xxxxx in check items [ldap] Added User-Password = {MD5}xxxxx in check items [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user mylogin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[pap] returns updated Found Auth-Type = PAP +- entering group authenticate {...} [pap] login attempt with password "mycleartextpassword" [pap] Using CRYPT encryption. [pap] Passwords don't match [...] ####################################################################### Is there a way to tell FR to try with others attributes ? My configuration is quite simple, here's my sites-enabled/proxy-inner-tunnel : server proxy-inner-tunnel { authorize { eap ldap pap } authenticate { eap pap } post-proxy { eap } } And the pap modules : pap { auto_header = yes } Any clue ? Thanks -- --------------------------- Christophe Saillard Université de Strasbourg Direction Informatique --------------------------- Tél : 03 90 24 03 17 Fax : 03 90 24 03 12 ---------------------------