Yet another PEAP/LDAP Question

[Jon P. Giza]

Hello all:

I am trying to setup a 802.1x WiFi authentication system using freeradius.
My setup is as follows:

Windows XP SP2 as the supplicant using PEAP/MSCHAPv2
Cisco Aironet 1231
Freeradius 1.1.0
IBM Lotus Domino LDAP

The process is mostly working - Freeradius binds to LDAP properly, the User
gets authorized, Freeradius pulls the correct password hash from the Domino
LDAP server.. But, then the MSCHAP portion fails.  Portion of the log is
shown below which I believe shows the problem.  

I am thinking that the problem is that I am not telling Freeradius how to
hash the supplied password correctly to match the Domino password.  The
aggravating part is that we are using the exact same Domino LDAP server to
authenticate our VPN users.  

Full (sanatized) copy of the debug output is here:
http://www.xbytenetworks.com/debug-log.txt
Copy of Radiusd.conf is here:  http://www.xbytenetworks.com/radiusd.conf

Thanks in advance for any help you can offer.

Jon


rlm_ldap: - authorize
rlm_ldap: performing user authorization for jon.giza
radius_xlat:  '(uid=jon.giza)'
radius_xlat:  'OU=Waukesha,OU=NA,O=MyCo'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in OU=Waukesha,OU=NA,O=MyCo, with filter
(uid=jon.giza)
rlm_ldap: Added password (6BDC5527858B28XXXXXXXXXEFAF2323F) in check items
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user jon.giza authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
  modcall[authorize]: module "ldap" returns ok for request 5
modcall: leaving group authorize (returns updated) for request 5
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/mschapv2
  rlm_eap: processing type mschapv2
  Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 5
  rlm_mschap: Told to do MS-CHAPv2 for jon.giza with NT-Password
  rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
  modcall[authenticate]: module "mschap" returns reject for request 5
modcall: leaving group MS-CHAP (returns reject) for request 5
  rlm_eap: Freeing handler
  modcall[authenticate]: module "eap" returns reject for request 5
modcall: leaving group authenticate (returns reject) for request 5
auth: Failed to validate the user.
Login incorrect: [jon.giza/<no User-Password attribute>] (from client
wifi.myco.com port 0)
  PEAP: Tunneled authentication was rejected.
  rlm_eap_peap: FAILURE
  modcall[authenticate]: module "eap" returns handled for request 5
modcall: leaving group authenticate (returns handled) for request 5
Sending Access-Challenge of id 152 to 10.100.224.235 port 1645
        EAP-Message =
0x010800261900170301001b1bb3ec40925325e30990ce3b14a78af7abc1f7222d06716740d2
ff
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x132496908cd3121e6967d7ddafcdd795
Finished request 5