stupid me! wasn't the freeradius config, that's just fine with ldap being edirectory. Only I had "overconfigured" my testaccount by setting Auth-Type=LDAP on it, so all other types were rejected ;-( Removed that ldap attribute and see, it works :-) Cheers, Lothar