Must set auth-type - but why?

[Alan DeKok]

John Horne wrote:
>   bob  Auth-Type = Local,User-Password := "abc",Proxy-To-Realm := LOCAL

  Don't set Auth-Type.  Use "Cleartext-Password", not "User-Password".
The entry should look like:

bob	Cleartext-Password := "abc", Proxy-To-Realm := LOCAL

> Whilst trying to sort this out, I noted Alan DeKok's comments (in the
> list archives) that generally Auth-Type does not need to be set (or
> indeed should *not* be set), and that FR will do the right thing. I am,
> therefore, a bit concerned that in this instance it seems that Auth-Type
> must be set for FR to work. I am wondering if this is because I have
> perhaps made some other error in the radiusd.conf file.

  It's not necessary.  The rest of the documentation says that you
should use Cleartext-Password.

  See "man rlm_pap" for more information.

> So my question is, does anyone have an explanation for this behaviour?
> Obviously it is great that our 'users' files entries work under
> FreeRadius 1.1.6 with only a minor change. However, since generally
> Auth-Type should not be required, it is a worry that we *have* to set it
> to get FR to work. Since the radiusd output shows that FR sees this is
> an MS-CHAP request, I would have thought it would handle it correctly.
> It doesn't, but instead treats it as a 'Local' type request.

  You have to set Auth-Type in your example only because you're using
User-Password.  You should be using Cleartext-Password instead.

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog