Hi, Im trying to use FR 3 to connect to remote AD via ldap module, tried playing with parameters but with no luck. Idk what i miss. I use own certificates. PEAP with MSCHAPv2.   I config. ldap module : server = "pegasus.fri.uniza.sk"         port = 636         base_dn = "dc=fri,dc=uniza,dc=sk"         user {                 base_dn = "ou=People,dc=fri,dc=uniza,dc=sk"                 filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"                 scope = 'sub'         }  options {                 chase_referrals = yes                 rebind = yes }  tls {                 ca_path = ${certdir}                    ca_file = ${certdir}/cacert.cer                 certificate_file = ${certdir}/friradius.cer                 private_key_file = ${certdir}/friradius.key                 require_cert    = "demand"         }   In sites-available/default and inner-tunnel I just added : authorize {         ldap } In eap I config >eap {        default_eap_type = peap        tls {                tls = tls-common        }        ttls {                tls = tls-common                default_eap_type = mschapv2                copy_request_to_tunnel = yes                use_tunneled_reply = yes                virtual_server = "inner-tunnel"        }        peap {                tls = tls-common                default_eap_type = mschapv2                copy_request_to_tunnel = yes                use_tunneled_reply = yes                virtual_server = "inner-tunnel"        }In mschap >mschap {        use_mppe = no        require_encryption = yes        require_strong = yes        passchange {        }}Also added realm to proxy >realm fri.uniza.sk {}Its starting all-right : "Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 47617 Ready to process requests." But when I try radtest :radtest -t mschap matisko@fri.uniza.sk <password>localhost 0 testing123rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=213, length=20Debug is : (1) suffix : Looking up realm "fri.uniza.sk" for User-Name = "hajtmanek@fri.uniza.sk"(1) suffix : Found realm "fri.uniza.sk"(1) suffix : Adding Stripped-User-Name = "hajtmanek"(1) suffix : Adding Realm = "fri.uniza.sk"(1) suffix : Authentication realm is LOCAL.(1)   [suffix] = ok(1) eap : No EAP-Message, not doing EAP(1)   [eap] = noop(1)   [files] = nooprlm_ldap (ldap): Reserved connection (4)(1) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})(1) ldap :    --> (uid=hajtmanek)(1) ldap : EXPAND ou=People,dc=fri,dc=uniza,dc=sk(1) ldap :    --> ou=People,dc=fri,dc=uniza,dc=sk(1) ldap : Performing search in 'ou=People,dc=fri,dc=uniza,dc=sk' with filter '(uid=hajtmanek)', scope 'sub'(1) ldap : Waiting for search result...(1) ERROR: ldap : Failed performing search: Please set 'chas e_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details.(1) ERROR: ldap : Server said: 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1.rlm_ldap (ldap): Released connection (4)rlm_ldap (ldap): Opening additional connection (5)rlm_ldap (ldap): Connecting to pegasus.fri.uniza.sk:636TLS: warning: cacertdir not implemented for gnutlsrlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successful(1)   [ldap] = fail(1)  } #  authorize = fail(1) Invalid user (ldap: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details.): [hajtmanek/pokus123] (from client localhost port 0)(1) Using Post-Auth-Type RejectBinding is succesfull, referals and rebind are changed. SSL handshake I think is ok (according to wireshark :) ).