Alan,
Now when I tried to login I can read the folling lines from Radius server log: The partial log is from RADIUS SERVER And no Radius proxy. Thanks Il 06 Lug 2017 13:06, "Danilo Raspa" <danilo.raspa@gmail.com> ha scritto:
Hi Alan, Thank you for your time. I removed the extra changes and now I'm at the same situation that I was in the first mail, now I added "nostrip" for my realm. I remember you that I modified the mods-enabled/eap with this two lines: eap { default_eap_type = peap proxy_tunneled_request_as_eap = no [..] } Now when I tried to login I can read the folling lines from Radius server log: (20) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (20) authenticate { (20) eap : Expiring EAP session with state 0x6ddc6af26dd57012 (20) eap : Finished EAP session with state 0x6ddc6af26dd57012 (20) eap : Previous EAP request found for state 0x6ddc6af26dd57012, released from the list (20) eap : Peer sent method MSCHAPv2 (26) (20) eap : EAP MSCHAPv2 (26) (20) eap : Calling eap_mschapv2 to process EAP data (20) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/ inner-tunnel (20) eap_mschapv2 : Auth-Type MS-CHAP { (20) WARNING: mschap : No Cleartext-Password configured. Cannot create LM-Password (20) WARNING: mschap : No Cleartext-Password configured. Cannot create NT-Password (20) mschap : Creating challenge hash with username: danilo.raspa@realm_example.com (20) mschap : Client is using MS-CHAPv2 (20) ERROR: mschap : FAILED: No NT/LM-Password. Cannot perform authentication (20) ERROR: mschap : MS-CHAP2-Response is incorrect (20) [mschap] = reject (20) } # Auth-Type MS-CHAP = reject Thank you in advance Danilo Danilo 2017-07-05 20:13 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Jul 5, 2017, at 11:54 AM, Danilo Raspa <danilo.raspa@gmail.com> wrote:
Hi Alan,
You're not testing it with the same user-name? Sorry Alan, I forgot to say that I've modified the delimiter from @ to %. Yes I used the same user-name.
That's wrong.
You should test ONE thing at a time. Don't make 3-4 changes, and wonder why it doesn't work. Make ONE change.
The answer I gave in my first message WILL WORK. The reason it doesn't work is because you went and changed lots of other things, and didn't re-run the same test.
Maybe yes... What do you mean with this phrase "You have the proxy editing the User-Name." ?
I meant you should add "nostrip", which makes the proxy stop editing the User-Name.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html