pubkey-auth, EAP-GTC

[dev at cyphermonks.org]

hi!

we want to use public-key-authentication with WPA2. the appropriate method to use seems to be EAP-GTC (plain, nothing around it needed). this (site config):
authorize {
        update control {
                Auth-Type := `query-user-pubkey_decrypt-challenge_compare.script '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}' '%{Challenge}'`
        } 
}
(with script returnig Accept or Reject) seems to work in general. first problem is that %{challenge} (or %{Challenge} or %{Access-Challenge}) seems not to expand to the challenge - what's the challenge's variable name? the second problem is: how can the challenge be set dynamically? setting "challenge" in eap{gtc{}} to a script using `` does not work.
anybody with hints on this?

regards,

        Chris