module fails parsing output, expecting operator

[Richard Green]

I am seeking help with an error parsing the output from an external exec program with FreeRADIUS 3 (a similar configuration, albeit some file movements for the updated config, worked without a problem with FreeRADIUS 2). The external exec program (/usr/local/bin/multiotp.php) seem to return a valid response (which is the same as for the working configuration for version 2), however FreeRADIUS 3 reports a parsing error at this point.

I've been using successfully using FreeRADIUS 2 for a while with MultiOTP to provide an authentication component where the password is a TOTP token and the username is synchronised with an Active Directory and am attempting to upgrade to FreeRADIUS 3.

My debug log is as follows:

.
.
.
(1) auth_log:    --> Mon Jan 27 09:08:08 2020
(1)     [auth_log] = ok
(1)     [chap] = noop
(1) mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'
(1)     [mschap] = ok
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "johnboy", looking up realm NULL
(1) suffix: No such realm "NULL"
(1)     [suffix] = noop
(1) eap: No EAP-Message, not doing EAP
(1)     [eap] = noop
(1)     [expiration] = noop
(1)     [logintime] = noop
(1) multiotp: Executing: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}:
(1) multiotp: EXPAND %{User-Name}
(1) multiotp:    --> johnboy
(1) multiotp: EXPAND %{User-Password}
(1) multiotp:    -->
(1) multiotp: EXPAND -src=%{Packet-Src-IP-Address}
(1) multiotp:    --> -src=127.0.0.1
(1) multiotp: EXPAND -chap-challenge=%{CHAP-Challenge}
(1) multiotp:    --> -chap-challenge=
(1) multiotp: EXPAND -chap-password=%{CHAP-Password}
(1) multiotp:    --> -chap-password=
(1) multiotp: EXPAND -ms-chap-challenge=%{MS-CHAP-Challenge}
(1) multiotp:    --> -ms-chap-challenge=0x5c1ed153a00f704f                                                                                                                                                                                                                                                                                                   [8/1872]
(1) multiotp: EXPAND -ms-chap-response=%{MS-CHAP-Response}
(1) multiotp:    --> -ms-chap-response=0x0001000000000000000000000000000000000000000000000000e6a71cf3f91b0c6218c456823e92d63ff58359976f0c272a
(1) multiotp: EXPAND -ms-chap2-response=%{MS-CHAP2-Response}
(1) multiotp:    --> -ms-chap2-response=
(1) multiotp: ERROR: Failed parsing output from: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: Expecting opera
tor
(1) multiotp: ERROR: Program returned code (0) and output 'Filter-Id += "Erica-Users",NT_KEY: EBEEE229885004ACEA55894DFDC1272D  '
(1)     [multiotp] = fail
(1)   } # authorize = fail
(1) Using Post-Auth-Type Reject
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1)   Post-Auth-Type REJECT {
.
.
.

(Note the wiki page https://wiki.freeradius.org/guide/multiOTP-HOWTO discusses version 3 but seems to reference version 2 file names, so is only useful as a guideline).

Thanks!

Richard Green
UNSW Sydney