LDAP & MSCHAP errors

[tnt at kalik.net]

>We are trying to set up freeRADIUS 2.1.1 against eDirectory LDAP and
>getting problems. 
>(Trying SLES 10 SP2 32bit and 64 bit)
>pap against LDAP works fine
>chap against LDAP works fine (With ntradping)

They used different password.

>BUT - MSCHAPv2 gives "FAILED: MS-CHAP2-Response is incorrect"
>Am I missing something required for MSCHAP to work? The NT-Password
>seems to be retrieved...
>

A coorect password.

>Working CHAP debug from ntradping:
>
>Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for check items in
>directory...
>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: acctFlags ->
>SMB-Account-CTRL-TEXT == "[UX         ]"
>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaNtPassword ->
>NT-Password ==
>0x4145394341303636374133413937333342303139423034323645363933373332
>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaLmPassword ->
>LM-Password ==
>0x3635423939303044343142344533363831394631304139333344343836384443
>Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for reply items in
>directory...
>Tue Nov 11 10:10:26 2008 : Info: [ldap] user testuser authorized to use
>remote access
>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: ldap_release_conn: Release
>Id: 0
>Tue Nov 11 10:10:26 2008 : Info: ++[ldap] returns ok
>Tue Nov 11 10:10:26 2008 : Info: ++[expiration] returns noop
>Tue Nov 11 10:10:26 2008 : Info: ++[logintime] returns noop
>Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing NT-Password from hex
>encoding
>Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing LM-Password from hex
>encoding
>Tue Nov 11 10:10:26 2008 : Info: [pap] Found existing Auth-Type, not
>changing it.
>Tue Nov 11 10:10:26 2008 : Info: ++[pap] returns noop
>Tue Nov 11 10:10:26 2008 : Info: Found Auth-Type = CHAP
>Tue Nov 11 10:10:26 2008 : Info: +- entering group CHAP {...}
>Tue Nov 11 10:10:26 2008 : Info: [chap] login attempt by "testuser"
>with CHAP password

*****
>Tue Nov 11 10:10:26 2008 : Info: [chap] Using clear text password
>"ommitted" for user testuser authentication.
*****

Where did that come from?

>Tue Nov 11 10:10:26 2008 : Info: [chap] chap user testuser
>authenticated succesfully

>Default configuration in modules/mschap and modules/chap
>In sites-enabled/default
>authorize {
>ldap
>}

That is obviously untrue from your debug.

Try doing pap with that NT-Password from ldap (remove clear text password
entry wherever it is).

Ivan Kalik
Kalik Informatika ISP