Alan DeKok <aland@deployingradius.com> wrote:
On Jul 6, 2015, at 1:56 PM, Zeus Panchenko <zeus@ibs.dn.ua> wrote:
as I understand from the debug bellow, I successfully pass authorization but fail to authenticate against eap_md5 ...
why?
Because you deleted the "pap" module from the "authorize" section. It should be listed last there. It takes care of normalizing passwords. In this case, turning Password-With-Header into Cleartext-Password.
emm ... as I figured out, the problem is in password format though ... it has to be the same as User-Name attribute value passed by NAS to FR ... in my case it was MAC address in lowercase without delimiters (it is how commutators, at least Cisco SF300 format User-Name) while in LDAP DB I'm trying to switch to the format of FR normalized MAC (uppercase dash delimited) ... is this problem due to pap issue you described? after I changed password to the value of User-Name attribute passed from NAS, the Access-Accept succeeded ... so, now I wonder, can I somehow rewrite User-Name value to use normalized MAC? I think it is good idea to use FR normalized MAC format in LDAP DB for login/password, and for that I'd like to put Calling-Station-Id value to User-Name and further, to use normalized format is it sound good? or may be this practice is already common and I am reinventing the wheel?
PLEASE just post "radiusd -X". This is what is requested in the
sorry, I will -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)