Two authorize instance

[Guillaume Chartrand]

>Guillaume Chartrand wrote:
>> I use freeradius 2.0.0 on red hat enterprise 3 AS and I set the
authorize section to check the user credential with an >sql database.
This configuration works.
>> But I want to know and how to do that if it's possible, if the user
isn't the sql database, can freeradius check >another database, like an
ldap database. So when the user is in the sql database he gain access,
if not he look in a >ldap database and if he are present with valid
credential, he gain access.
>
>  Yes. 

>	...
>	sql
>	if (notfound) {
>		ldap
>	}

> See "man unlang".

>  Alan DeKok.
I write the if in my authorize section.. here some of my config in
site-enabled/default
authorize {
	preprocess
	chap
	mschap
	unix
	suffix
	sql
	if (notfound) {
                ntlm_auth
      }
	eap
	expiration
	logintime
	pap
}
authenticate {

        ntlm_auth
        Auth-Type PAP {
                pap
        }
        Auth-Type CHAP {
                chap
        }	
Auth-Type MS-CHAP {
                mschap
        }
        unix
        eap
}

And here is my radiusd.conf
modules {
        exec ntlm_auth {
                wait = no
                program = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name:-None}
--domain=%{mschap:NT-Domain:-intranet}
--challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"
	  }
$INCLUDE eap.conf
        mschap { 
		with_ntdomain_hack = yes
		ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name:-None}
--domain=%{mschap:NT-Domain:-intranet}
--challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"
                }
}

If I comment in the mschap module the ntlm_auth and the user is present
in sql, he's accepted. If he's not in sql but in my Active directory
database, he's rejected

If I comment out the ntlm_auth line, my sql user is rejected but my AD
user was accepted. So Where I'm wrong, I want to use both authorize
database.

Thank