outer identity anonymous is being rejected

[Alan DeKok]

Godfrey Peart wrote:
> My FR 2.1 is set to authenticate users via PEAP + EAP-TTLS, this works 
> fine but some users are being rejected
>  because their wireless client allows the setting of an outer identity:
> anonymous or something else, which is not a valid username.

  You need to separate the rules for the outer && inner identity.

  The default configuration has the same "users" file being processed
for both the outer && inner sessions.  You might need to create a rule
to ignore it on the outer tunnel.

> So it's being rejected. How do I get the inner identity which contains a
> valid username to be processed instead of the outer identity.
>  I've seen some posts about using* Autz-type INNER* options but have
> merely succeded in breaking my test system when tryng it out.

  Don't use Autz-Type in 2.1.x.  "unlang" is better and more powerful.

  Try editing raddb/sites-enabled/default, and commenting out the
"files" line in the "authorize" section.  This will skip the "users"
file outside of the tunnel.

  Or, add a separate "files" module, and run that one inside of the tunnel.

  Alan DeKok.