Alan, Thanks for the response.

Do you mean EAP-MD5? I'm not sure what MD5-Challenge is...

Yes - EAP-MD5, The windows side (supplicant) is set to MD5-Challenge

...

I did get EAP to work when I supply the User-Password attribute in the users file, but I would like LDAP to fetch this if it is possible.

If you're using LDAP, it should be doing that already.

I don't think it is configured right. So far I have been using LDAP for groupmembership searches only. How do you tell LDAP to fetch User-Password attribute?

...

If I remove the User-Password attribute in the users file, the dubug out shows: User-Password is required for EAP-MD5 authenitication.

Are you getting the User-Password attribute from LDAP? The debug log should show this.

...

Username Password Domain

If you supply all three values, the debug shows:

Identity does not match user-name

You're re-writing the User-Name attribute somewhere. Again, the debug log will show this.

I didn't see anything in the log. If I provide the domainname debug shows username as domain\\username, LDAP shows it as domain\username, and rlm_eap complains about Identity not matching. -Robert Graham