Hi, Exactly the same config used between 2.0.3 and 2.0.4, but now the LDAP module fails lookups because it claims it can't find the User-Name attribute.... PEAP: Got tunneled EAP-Message EAP-Message = 0x02fe004d1a02fe004831623806335a6bfd5678650649fdd76c200000000000000000949c9809c8a97e6c717a5 PEAP: Setting User-Name to ac221@sussex.ac.uk PEAP: Sending tunneled request EAP-Message = 0x02fe004d1a02fe004831623806335a6bfd5678650649fdd76c200000000000000000949c9809c8a97e6c717a5 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ac221@sussex.ac.uk" State = 0xc771177ac78f0d80e7ad35c717d8d32f Framed-MTU = 1480 NAS-IP-Address = 139.184.6.156 NAS-Identifier = "hp-e-falm-g-77-sw1" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001c2ec47180" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" server default-inner { +- entering group authorize expand: %{outer.request:Realm} -> local expand: %{outer.request:NAS-Flags} -> 010010110000000 expand: %{outer.request:SS-Flags} -> 0000000000 expand: %{outer.request:Supplicant-Flags} -> 0001000000 expand: %{outer.request:Called-Station-SSID} -> ++[request] returns notfound ++? if ("%{User-Name}") expand: %{User-Name} -> ac221@sussex.ac.uk ? Evaluating ("%{User-Name}") -> TRUE ++? if ("%{User-Name}") -> TRUE ++- entering if ("%{User-Name}") +++? if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) expand: %{User-Name} -> ac221@sussex.ac.uk ? Evaluating ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) -> TRUE +++? if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) -> TRUE +++- entering if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) expand: %{1} -> ac221 ++++[request] returns notfound expand: %{3} -> sussex.ac.uk expand: %{%{3}:-sussex.ac.uk} -> sussex.ac.uk ++++[request] returns notfound +++- if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) returns notfound +++ ... skipping else for request 5: Preceding "if" was taken ++- if ("%{User-Name}") returns notfound rlm_ldap: - authorize rlm_ldap: Attribute "User-Name" is required for authorization. ++[ldap] returns noop Relevant filter line in LDAP is : filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Why is there now a static requirement for the User-Name attribute to be present anyway? Especially when the filter is defined in the config... -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900