I have multiple MSCHAP definitions in my setup each pointing to different ad domains and all is working well. The authenticate section is defined as such

Auth-Type MS-CHAP { mschap-a { reject =2 } if(reject) {

mschap-b

reject=2 } } You *should* be deciding what domain to use up front, and then selecting the appropriate MS-CHAP module based on that. That way, the "mschap-a" module doesn't get overloaded with requests which really should be for "mschap-b"

Now I am trying to check in post auth if user authenticated via mschap-a go to VLAN A(vsa) else goto VLAN B(vsa). What I cant figure out is how do I reference these in the post auth block as if I try looking for return code from the modules You decide which domain it is at the start, and use that to do VLAN assignment. Also I need to log in linelog which mschap module authenticated the user ? You decide which domain it is at the start, and use that in the logs. Alan DeKok.

Thanks Alan, that would be my preference as well. Unfortunately we can get some users who do not put in domain prefix/suffix... So basically there isnt a way we can find out in that case ? Sent: Monday, June 05, 2017 at 3:45 PM From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Subject: Re: Post Auth and Logging Multiple MSCHAP modules On Jun 5, 2017, at 10:16 AM, Arnab Roy <arnabroy@mail.com> wrote: - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html References 1. http://www.freeradius.org/list/users.html

On Jun 5, 2017, at 10:56 AM, Arnab Roy <arnabroy@mail.com> wrote:

Thanks Alan, that would be my preference as well. Unfortunately we can get some users who do not put in domain prefix/suffix...

So basically there isnt a way we can find out in that case ? Reject them if they don't use the proper domain. Or, use "unlang" to set the domain after they've successfully authenticated: mschap-a if (ok) { update request { Realm := "mschap-a" } } And then use that in the post-auth section. Alan DeKok.

I should have mentioned I tried this and the problem seems to be mschap-a ---> This guy always returns noop ? if (ok) { update request { Realm := "mschap-a" } } I might have inadvertently introduced this as we are not directly calling ntlm_auth instead it goes to a shell script which does some checking on ldap and tries to figure out if the user has put in a UPN or SAMAccountName. I am passing the return code from NTLM-auth as a return code for the bash script should this has have an impact on this ? What is the expected return code for sucessful auth 0/1 ? Many Thanks Arnab Sent: Monday, June 05, 2017 at 4:02 PM From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Subject: Re: Post Auth and Logging Multiple MSCHAP modules - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html References 1. http://www.freeradius.org/list/users.html

Hi Alan, yes that is how I came to conclusion that the call to mschap-a is returning noop ? The return code..is 0 as per debug...still module return code check tells noop in unlang? Sent: Monday, June 05, 2017 at 4:38 PM From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Subject: Re: Post Auth and Logging Multiple MSCHAP modules On Jun 5, 2017, at 11:13 AM, Arnab Roy <arnabroy@mail.com> wrote:

I should have mentioned I tried this and the problem seems to be

mschap-a ---> This guy always returns noop ?

What is the expected return code for sucessful auth 0/1 ? Yes. Alan DeKok.

There *is* a debug mode which shows you what's going on... - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html References 1. http://www.freeradius.org/list/users.html

On Mon, Jun 05, 2017 at 10:45:55AM -0400, Alan DeKok wrote:

You *should* be deciding what domain to use up front, and then selecting the appropriate MS-CHAP module based on that. That way, the "mschap-a" module doesn't get overloaded with requests which really should be for "mschap-b"

About the only time I've found this useful is in the transition stage between two AD domains when the list of users in each domain is changing rapidly as they move over. But this is just a temporary configuration. In that situation, however, nobody cares about *where* the auth is actually going. And at the end of the move the old mschap config is just removed. Other than that, different realms or an LDAP lookup can easily find the right domain to authenticate against first. -- Matthew