Hi Alan, thanks for your quick response.

Which should be clear. The server is unable to get the Cleartext-Password from LDAP. As such, it can't do MS-CHAP.

...

Do you mean, I shall get back the password from LDAP in Cleartext form?? Our eDir sends it in a hashed form. It works so with freeradius2 for years.

Read what you've done to the "inner-tunnel" virtual server,

...

I´ve gone through this module several times in the last weeks and have no further idea ...

and ask yourself: "Where is Cleartext-Password supposed to be coming from?"

...

  this is exactly what I´m asking myself ... with no clear answer and idea what to change. Sorry, I´m no Server-, Freeradius- or Linux-Expert. Normally I´m working with Network-Devices, but now trying to migrate a very old  freeradius installation, because there´s no other person in our office able to do this.

Thanks for your patience. Regards Ronald