FreeRadius eDirectory integration help

I'm trying to get freeradius/eDirectory/802.11 authentication working for a educational wireless environment and need some assistance. I'm working with SLES11sp1/OES11 and FreeRadius rpm version 2.1.1-7.12.1. I'm using a couple of HP MSM422 WAPs but the majority of the WAP's are Ruckus, with a ZoneDirector 3000. My goal is to provide private wireless networks that require user authentication and either place students and staff on different wireless vlans or return group membership to our firewall to differentiate web content filtering.

I used this document for my initial config: https://www.netiq.com/documentation/...adiusadmin.pdf.

Right now all I've been trying to do is get a user to authenticate and connect via 802.1x.

Here's what I have so far:

ldap file:

ldap {}


users file:

DEFAULT Ldap-Group == "cn=StaffMember,o=ORG"
eap.conf:

eap { }

If there are other relevant config files that someone would like to see, please let me know.

I have an HP MSM422 WAP configured with encryption set to WPA2/AES and Radius authentication. Here is an example of the radiusd debug output:

rad_recv: Access-Request packet from host 192.168.3.30 port 32772, id=99, length=363 +- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "UserA", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 17 length 89
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] EAP type mschapv2
[peap] Got tunnled request server (null) {
PEAP: Setting User-Name to UserA
Sending tunneled request
EAP-Message = 0x021100421a0211003d3117c29ec2260e40cf8966bf3d774e df19000000000000000025114d54fd90897f6e1e377172baef 7c6ad9b514c3dde99a006861736c657474 server inner-tunnel {
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
[suffix] No '@' in User-Name = "UserA", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 17 length 66
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
rlm_ldap: Entering ldap_groupcmp()
[files] expand: o=ORG -> o=ORG
[files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details
[files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=UserA)
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in o=ORG, with filter (uid=UserA)
rlm_ldap: ldap_release_conn: Release Id: 0
[files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ld ap-UserDn}))(&(objectClass=GroupOfUniqueNames)(unique member=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dUserA\2 cou\3dADM\2cou\3dCE\2cou\3dAD\2co\3dORG))(&(object Class=GroupOfUniqueNames)(uniquemember=cn\3dUserA\ 2cou\3dADM\2cou\3dCE\2cou\3dAD\2co\3dORG)))
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in cn=StaffMember,o=ORG, with filter (|(&(objectClass=GroupOfNames)(member=cn\3dUserA\2 cou\3dADM\2cou\3dCE\2cou\3dAD\2co\3dORG))(&(object Class=GroupOfUniqueNames)(uniquemember=cn\3dUserA\ 2cou\3dADM\2cou\3dCE\2cou\3dAD\2co\3dORG)))
rlm_ldap::ldap_groupcmp: User found in group cn=StaffMember,o=ORG
rlm_ldap: ldap_release_conn: Release Id: 0
[files] users: Matched entry DEFAULT at line 214
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Told to do MS-CHAPv2 for UserA with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
Login incorrect: [UserA/<via Auth-Type = EAP>] (from client comedwap port 0 via TLS tunnel)
} # server inner-tunnel
[peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 99 to 192.168.3.30 port 32772 Finished request 26.
Going to the next request



Thanks for any assistance.