eap_peap: We sent a success, but the client did not agree [FreeRadius + samba4 AD + dynamic vlans]

[Elias Pereira]

Hello guys,

At first everything is ok with the settings. I made internal tests with
radtest and the authentication of a domain user is done correctly. I also
tested with pfsense's captiveportal and it worked correctly.

We have a wifi controller from the motorola and created a ssid and set the
AAA profile as it showed in the extreme support itself.

After trying to connect via mobile with android, the following error occurs:

Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: [eaptls process] = ok
Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Session established.
Decoding tunneled attributes
Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: PEAP state send tlv success
Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Received EAP-TLV response
Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Client rejected our
response.  The password is probably incorrect
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but
the client did not agree*
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP
(25) session.  EAP sub-module failed*
Wed Jul 18 14:44:25 2018 : Debug: (71) eap: Sending EAP Failure (code 4) ID
12 length 4
Wed Jul 18 14:44:25 2018 : Debug: (71) eap: Failed in EAP select
Wed Jul 18 14:44:25 2018 : Debug: (71)     modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Jul 18 14:44:25 2018 : Debug: (71)     [eap] = invalid
Wed Jul 18 14:44:25 2018 : Debug: (71)   } # authenticate = invalid
Wed Jul 18 14:44:25 2018 : Debug: (71) Failed to authenticate the user
Wed Jul 18 14:44:25 2018 : Debug: (71) Using Post-Auth-Type Reject
Wed Jul 18 14:44:25 2018 : Debug: (71) # Executing group from file
/etc/freeradius/3.0/sites-enabled/default
Wed Jul 18 14:44:25 2018 : Debug: (71)   Post-Auth-Type REJECT {
Wed Jul 18 14:44:25 2018 : Debug: (71)     modsingle[post-auth]: calling
ldap (rlm_ldap)

https://pastebin.com/raw/Nzki0y1d (sites-enable/default and inner-tunnel

Has anyone ever had this problem?

-- 
Elias Pereira