The DVLAN is after a successful authentication, so I don't *think* it matters how the password is stored and such. If you can authenticate ok, then you move to the authorize section and do DVLAN through whatever means. Note: I am a FR beginner myself, don't take my word for anything! ----- Original Message ----- From: stich86 [mailto:stich86@gmail.com] Sent: Tuesday, July 26, 2011 01:06 PM To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Subject: LDAP SHA1 Password, EAP-PAP and Dynamic VLAN Hello, i'm trying to figure out how to configure FreeRadius with SHA1 hashed password on openldap backend. Actually i've already a configuration to dynamic assing VLAN ID with MS-CHAPv2 (that works on OSX, Linux and Windows XP/Vista/7). I want to switch to SHA1 because we have already a LDAP DB populated with all SHA1 password. I've read that it's possibile with the use of PAP (OSX and Linux have no problem to support it, for Windows it's necessary another supplicant.. no problem). I've done some tests.. can actually authenticated based on the logs and the switch info, but Dynamic VLAN isn't configured on the switch ports. So.. before waste my time.. Is it REAL possible to use SHA1 with PAP to do Dynamic VLAN association? Thanks to anyone :) -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-SHA1-Password-EAP-PAP-and-Dynam... Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

Actually i've already a configuration to dynamic assing VLAN ID with MS-CHAPv2

What reply attribute(s) are you passing to the switch in this case?

I've done some tests.. can actually authenticated based on the logs and the switch info, but Dynamic VLAN isn't configured on the switch ports.

If you are authenticating successfully, then check what attributes are being returned to the switch and compare to the scenario above when you said it worked! Then, fix your config to return the proper attribute with the proper value.