Hi I have FreeRadius 2.0 server with AD as user store. Authenticating using EAP-PEAP-MSCHAP2.Local realm is defined in proxy.conf. Authentications works fine without realm added to the username. As soon as I authenticate using username with realm, i.e. username@realm.com, authentication fails. The reason for failure is clear, it fails because radius server mschap module creates challenge hash with username which includes realm. I need the radius mschap module to create hash from stripped username, i.e. which doesn't include the realm. Any ideas? Please see radius debug log below: rad_recv: Access-Request packet from host 192.168.1.254 port 55769, id=138, length=376 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5@igor.local" State = 0x3ce95d9d3fed44ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x020400d01980000000c61603010086100000820080791cc56766422be7f48414f5942dda519afd607aea2fae890f9236e8af61cf71c66f4f80a5d427672d7f949a3fa163b959f0f1957f382f533a3f9c23d576dafcb5d36ca04dc7d0002203513a23b9394b75cf98f241a6c585583593f6622829a39a736160f0f83b567fa7bbc253558191630071d1889827f6118f366040f69d8814030100010116030100307173492977a9f772a302c0ecb7d2612700f9433dce8e08ff0e74b84dbc62de5fe5a95921f364f8c68dd38484550022ae Message-Authenticator = 0x9a61469cb26792ebd980f294bd9a64c9 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5@igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 138 to 192.168.1.254 port 55769 EAP-Message = 0x0105004119001403010001011603010030b0496fb6db5990b1f6a9cf2425dd8587e12b8f4e394f4bd8ccd2c077fe9ba54077bc170e9af421dda6e1deba0235ae8b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ce95d9d38ec44ec4019661d07f2a324 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 56590, id=139, length=174 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5@igor.local" State = 0x3ce95d9d38ec44ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x020500061900 Message-Authenticator = 0xd034f4a268e3ac260f43575b92006929 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5@igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 139 to 192.168.1.254 port 56590 EAP-Message = 0x0106002b190017030100205c4bae935a0f79fa0d08a9ce246433654e7edd61806e1f065cc4bdc32958e161 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ce95d9d39ef44ec4019661d07f2a324 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 53256, id=140, length=264 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5@igor.local" State = 0x3ce95d9d39ef44ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x02060060190017030100209cc7c674b7a342e6bec99adea0f61331d5f99b0f6a5950927de5ae55a0bcbcbd1703010030a3f8d19a2da43ad4bee38bdadeeb8049f2ccd3b6452763ed52490a8ff701f7dddeb0d19ec99dc82884df40d0c650c45c Message-Authenticator = 0x4c2f97f2d3325123f0616a879cb73a5f NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5@igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - user5@igor.local [peap] Got inner identity 'user5@igor.local' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x020600150175736572354069676f722e6c6f63616c server { [peap] Setting User-Name to user5@igor.local Sending tunneled request EAP-Message = 0x020600150175736572354069676f722e6c6f63616c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user5@igor.local" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok [eap] EAP packet type response id 6 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[mschap] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0107002a1a010700251028ee58cd731c7f9fdd4de2f82cc1bf8e75736572354069676f722e6c6f63616c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2798eb6d20828b51434e222e2c4892 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0107002a1a010700251028ee58cd731c7f9fdd4de2f82cc1bf8e75736572354069676f722e6c6f63616c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2798eb6d20828b51434e222e2c4892 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 140 to 192.168.1.254 port 53256 EAP-Message = 0x0107004b190017030100400140898f0ff025ef80db345ef75a51b4a94d6b114a1d16ef08e1fc4c2d9de5d9895bd09efcdbc614e3886fa835507c92e6b34d2d657247692685e84c0e1f540f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ce95d9d3aee44ec4019661d07f2a324 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 47603, id=141, length=312 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5@igor.local" State = 0x3ce95d9d3aee44ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x020700901900170301002045693fe624f18512a0f9c83b0b896669c3a55066d0d54494bdee159a241df7cf170301006081573695ccc8dd51297f737d1ab47a212c08801a46c831418959b106028089aac0d7cec2f5aa0740909f7ae40d4274bd4534fa24cc41b9c775c3202ad337b19d7b7062c980579e7d31ca54439954aedcb279acd9cc65df2c1fdb85039fb26142 Message-Authenticator = 0x97fd332a0965353e5459137c179a2c62 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5@igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0207004b1a02070046317c71750309db8428b4ec154f7e6c5b840000000000000000a333f4999fd9698891d2fbc675892007431387796abfa13b0075736572354069676f722e6c6f63616c server { [peap] Setting User-Name to user5@igor.local Sending tunneled request EAP-Message = 0x0207004b1a02070046317c71750309db8428b4ec154f7e6c5b840000000000000000a333f4999fd9698891d2fbc675892007431387796abfa13b0075736572354069676f722e6c6f63616c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user5@igor.local" State = 0x6d2798eb6d20828b51434e222e2c4892 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok [eap] EAP packet type response id 7 length 75 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[mschap] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: user5@igor.local [mschap] Told to do MS-CHAPv2 for user5@igor.local with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{User-Name} -> user5@igor.local [mschap] expand: %{%{User-Name}:-None} -> user5@igor.local [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=user5@igor.local [mschap] Creating challenge hash with username: user5@igor.local [mschap] expand: %{mschap:Challenge} -> 13479bee1886303a [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=13479bee1886303a [mschap] expand: %{mschap:NT-Response} -> a333f4999fd9698891d2fbc675892007431387796abfa13b [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=a333f4999fd9698891d2fbc675892007431387796abfa13b WARNING: The "idmap uid" option is deprecated WARNING: The "idmap gid" option is deprecated Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 141 to 192.168.1.254 port 47603 EAP-Message = 0x0108002b19001703010020849be569aa66a8021ded29e15410bf74c59467c7db34f5995d1b6f91ebe9f22f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ce95d9d3be144ec4019661d07f2a324 Finished request 7. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 49384, id=142, length=248 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5@igor.local" State = 0x3ce95d9d3be144ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x02080050190017030100200ebc17e9bd20cc45f1c1772575868316464689e08bba6f4d934e5e1e4be3b040170301002078626c70503034ac41b926af5220e841c57e097b8fe870a8a49fdf71c2e749f8 Message-Authenticator = 0x658f4273b0c1858d67761528c08eac05 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5@igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user5@igor.local attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 142 to 192.168.1.254 port 49384 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. Cleaning up request 0 ID 134 with timestamp +3480 Cleaning up request 1 ID 135 with timestamp +3480 Cleaning up request 2 ID 136 with timestamp +3480 Cleaning up request 3 ID 137 with timestamp +3480 Cleaning up request 4 ID 138 with timestamp +3480 Cleaning up request 5 ID 139 with timestamp +3480 Cleaning up request 6 ID 140 with timestamp +3480 Cleaning up request 7 ID 141 with timestamp +3480 Waking up in 1.0 seconds. Cleaning up request 8 ID 142 with timestamp +3480 Ready to process requests.