Hi, I am trying to set up my FreeRadius 1.0.4 to do wireless EAP-TTLS. I got it working for EAP-TLS and EAP-PEAP, so I know my config is basically correct. The problem I am having is that I would like to use the same userid for the "outer" and "inner" EAP identity string. So in my user's file, I have a line that looks like: "qa" Auth-Type := EAP, User-Password == "qa" Now when my client tries to authenticate, the TLS tunnel is set up OK, but when we get to the inner MSCHAP protocol, FreeRadius still thinks we are doing EAP and rejects the authentication attempt. Here is a snippet from the output of radiusd -A -X (other): SSL negotiation finished successfully <--- (so far so good) SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 3 to 10.222.0.18:1025<http://10.222.0.18:1025/> EAP-Message = 0x0104004515800000003b140301000 10116030100303e6bb07c9ba8bcdd94b7f0ee66d43b439d87b89b99025c1310aa4dc9bf7491555d4d0888ef91a0c7f628b79868ced090 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d987f832d6f6ed2f7e42b0fe6b2d77b Finished request 3 Going to the next request Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.222.0.18:1025<http://10.222.0.18:1025/>, id=4, length=353 Message-Authenticator = 0x1d82927ff8e036beeb0aca3ee45c1608 Service-Type = Framed-User User-Name = "qa" Framed-MTU = 1488 State = 0x3d987f832d6f6ed2f7e42b0fe6b2d77b Called-Station-Id = "00-03-7F-04-03-F6:TomAP48" Calling-Station-Id = "00-03-7D-00-06-32" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400b015001703010020fb074fcc5e5f2df2d24fcee30e4d18a4638a526f045e84651467daae520e2f4417030100809d045521172337970b871775afd53193cae98494128c873dd3786f75c340f7c4992c0f7aa2c4fdecdf595ec0ec65a9692e448c5f7df7b9bff4d975bd7fb112a1cec89c01ea8aba0c328d087ffee23a6637970e1dab1fc959838cbf8e42dae0832c35f409b77a61229991f6ee238292239bec74fc6d5f09a16979aa6f5af4a3c9 NAS-IP-Address = 10.222.0.18 <http://10.222.0.18/> NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "qa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 176 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry qa at line 104 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' <--- (At this point, freeradius correctly sets auth-type MSCHAP) modcall[authorize]: module "mschap" returns ok for request 4 rlm_realm: No '@' in User-Name = "qa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry qa at line 104 <---- (Uh, oh, we matched that qa line again, and now.....) modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns ok for request 4 rad_check_password: Found Auth-Type EAP <----- (auth-type is set to EAP again, which is not what I want.) auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message modcall[authenticate]: module "eap" returns fail for request 4 modcall: group authenticate returns fail for request 4 auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select I can get around the problem by putting two lines in my users file: "outerqa" Auth-Type := EAP, User-Password == "qa" "innerqa" Auth-Type := MS-CHAP, User-Password == "qa" But I would like to avoid the complexity of setting up two user identities, one for the outter and one for the inner. Is there any way to configure FreeRadius so that a single EAP identity can be used for EAP-TTLS? Thanks in advance for any help you can give. Michael