CHAP-Challenge Question

[Jeremiah]

We are using freeradius 2.1.10.

We are using a Mikrotik as a nas and trying to use CHAP for hotspot 
access.  I have a test user setup and can use ntradping to Access-Accept 
back.
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 174.57.91.24 port 1026, id=7, 
length=52
         User-Name = "testwifi"
         CHAP-Password = 0xe89981fe6bf05bf6af662769cbb1a084f8
# Executing section authorize from file /opt/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
[chap] Setting 'Auth-Type := CHAP'
++[chap] returns ok
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[sql]   expand: %{User-Name} -> testwifi
[sql] sql_set_user escaped user --> 'testwifi'
[sql] User found in radcheck table
++[sql] returns ok
++[mschap] returns noop
Found Auth-Type = CHAP
# Executing group from file /opt/etc/raddb/sites-enabled/default
+- entering group CHAP {...}
[chap] login attempt by "testwifi" with CHAP password
[chap] Using clear text password "testblah" for user testwifi 
authentication.
[chap] chap user testwifi authenticated succesfully
++[chap] returns ok
Login OK: [testwifi] (from client mikrotik port 0)
# Executing section post-auth from file /opt/etc/raddb/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 7 to 174.57.91.24 port 1026
         Mikrotik-Rate-Limit := "256k/512k"
         Session-Timeout += 120
Finished request 1.
Going to the next request

When a request comes in from the Tik , it adds a CHAP challenge and the 
Chap password obviously is differejt and the request fails.

rad_recv: Access-Request packet from host 203.45.185.115 port 33303, 
id=6, length=246
         NAS-Port-Type = Wireless-802.11
         Calling-Station-Id = "00:12:AB:36:3E:0C"
         Called-Station-Id = "server1"
         NAS-Port-Id = "bridge1"
         User-Name = "testwifi"
         MS-CHAP-Domain = "wifi.net"
         NAS-Port = 2157969420
         Acct-Session-Id = "80a0000c"
         Framed-IP-Address = 192.168.10.246
         Mikrotik-Host-IP = 192.168.10.246
         CHAP-Challenge = 0xf3663a1617d0a1d2537c157ee4ef1e77
         CHAP-Password = 0xedcbec473f0529359a785e47ada0e0b23e
         Service-Type = Login-User
         WISPr-Logoff-URL = "http://0.0.0.0/logout"
         NAS-Identifier = "MikroTik"
         NAS-IP-Address = 203.45.185.115
         Mikrotik-Realm = "wifi.net"
# Executing section authorize from file /opt/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
[chap] Setting 'Auth-Type := CHAP'
++[chap] returns ok
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[sql]   expand: %{User-Name} -> testwifi
[sql] sql_set_user escaped user --> 'testwifi'
[sql] User found in radcheck table
++[sql] returns ok
++[mschap] returns noop
Found Auth-Type = CHAP
# Executing group from file /opt/etc/raddb/sites-enabled/default
+- entering group CHAP {...}
[chap] login attempt by "testwifi" with CHAP password
[chap] Using clear text password "testblah" for user testwifi 
authentication.
[chap] Password check failed
++[chap] returns reject
Failed to authenticate the user.
Login incorrect (rlm_chap: Wrong user password): 
[testwifi/<CHAP-Password>] (from client mikrotik port 2157969420 cli 
00:12:AB:36:3E:0C)
Using Post-Auth-Type Reject
# Executing group from file /opt/etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> testwifi
  attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 22 for 1 seconds
Going to the next request
Waking up in 0.3 seconds.

What basic element am I failing to understand?  If the chap challenge 
string is sent in, should freeradius be able to use that with the 
chap-password to accept the user?

Thanks

Jeremiah