Dears, If I have an outer tunnel like in freeradius 2.2.2 like the following, why should Stripped-User-Name be known in the following interactions that visit the outer tunnel, and the whole if block is executed each time? I think it was supposed to have Stripped-User-Name set on the first entry, and then have it available to the next interactions. Regards, Rui Ribeiro authorize { auth_log if (!(Stripped-User-Name)) { if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "MyDomain") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := TO_EDUROAM } } } } eap { ok = return } }