Приветствую. Прошу помощи, ибо совсем сломал мозг следующей задачей:
- Необходимо реализовать процедуру аутентификации пользователей при коннекте к беспроводной сети и направление пользователя в указанный в аккаунте VLAN. Wi-Fi точка настроена на обращение к Radius'у, который, в свою очередь, должен запрашивать аккаунты у LDAP'а. Между Радиусом и точкой настроен протокол PEAP для аутентификации, а PEAP, в свою очередь, использует EAP-MSCHAPv2.
НО! На данный момент работает только схема, при которой аккаунт хранится в файле users на Радиусе. А забрать аккаунт с LDAP'а ни в какую не выходит.

Выкладываю конфиги
radiusd.conf (не полностью, лишь значимую часть):

!----------------------
proxy_requests  = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
modules {
$INCLUDE ${confdir}/modules/
$INCLUDE eap.conf
$INCLUDE sql.conf
$INCLUDE sql/mysql/counter.conf
}
$INCLUDE policy.conf
$INCLUDE sites-enabled/
!EOF----------------------

clients.conf:
!----------------------
client localhost {
        ipaddr = 127.0.0.1
        secret = testing123
        require_message_authenticator = no
        nastype = other
}
client 192.168.60.20/32 {
        secret = ***
        shortname = wifi
        nastype = cisco
}
!EOF----------------------

eap.conf:
!----------------------
eap {
        default_eap_type = peap
        timer_expire = 60
        ignore_unknown_eap_types = yes
        cisco_accounting_username_bug = no
        max_sessions = 2048
        tls {
                      certdir = ${confdir}/certs
                      cadir = ${confdir}/certs
                      private_key_file = ${certdir}/newkey.pem
                      certificate_file = ${certdir}/newcert.pem
                      CA_file = ${cadir}/cacert.pem
                      dh_file = ${certdir}/dh
                      random_file = /dev/urandom
                      fragment_size = 1024
                      include_length = yes
                      cipher_list = "DEFAULT"
                      make_cert_command = "${certdir}/bootstrap"
                      cache {
                              enable = no
                      }
          }

        ttls {
                       default_eap_type = peap
                       copy_request_to_tunnel = no
                       use_tunneled_reply = yes
                       virtual_server = "inner-tunnel"
        }

        peap {
                       default_eap_type = mschapv2

                       copy_request_to_tunnel = no
                       use_tunneled_reply = yes
                       proxy_tunneled_request_as_eap = no
                       virtual_server = "inner-tunnel"
        }

        mschapv2 {
                        with_ntdomain_hack = yes
                        use_mppe = no
                        require_encryption = no
                        require_strong = no
                        authtype = MS-CHAPv2
        }
}
!EOF----------------------

ldap.attrmap (также не полностью):
!----------------------
checkItem       Auth-Type                       radiusAuthType
checkItem       LM-Password                     lmPassword
checkItem       NT-Password                     ntPassword
checkItem       LM-Password                     sambaLmPassword
checkItem       NT-Password                     sambaNtPassword
checkItem       LM-Password                     dBCSPwd

#мною прописанные
checkItem       Cleartext-Password              userPassword
replyItem       Tunnel-Type                     radiusTunnelType
replyItem       Tunnel-Medium-Type              radiusTunnelMediumType
replyItem       Tunnel-Private-Group-ID         radiusTunnelPrivateGroupId
!EOF----------------------

proxy.conf:
!----------------------
proxy server {
        default_fallback = no
}

home_server localhost {
        type = auth
        ipaddr = 127.0.0.1
        port = 1812
        secret = testing123
        response_window = 20
        zombie_period = 40
        revive_interval = 120
        status_check = status-server
        check_interval = 30
        num_answers_to_alive = 3
}
!EOF----------------------

users (аутентификация именно для этого юзера работает прекрасно):
!----------------------
vlan50  Cleartext-Password :="***"
        Tunnel-Private-Group-ID = 50,
        Tunnel-Type = "VLAN",
        Tunnel-Medium-Type = "IEEE-802"
!EOF----------------------

sites-enables/default:
!----------------------
authorize {
        auth_log
        mschap
        eap {
              ok = return
        }
        files
        ldap
}

authenticate {
        Auth-Type MS-CHAP {
              mschap
        }
        Auth-Type LDAP {
                ldap
        }
        eap
}

preacct {
        files
}

accounting {
        detail
        sql
        attr_filter.accounting_response
}

session {
        radutmp
}

post-auth {
        exec
        Post-Auth-Type REJECT {
                attr_filter.access_reject
        }
}

pre-proxy {
}

post-proxy {
        eap
}
!EOF----------------------

sites-enables/inner-tunnel:
!----------------------
server inner-tunnel {

listen {
       ipaddr = 127.0.0.1
       port = 18120
       type = auth
}

authorize {
        mschap
        ntdomain
        update control {
               Proxy-To-Realm := LOCAL
        }
        inner-eap {
                ok = return
        }
        files
        ldap
        expiration
        logintime
}

authenticate {
        Auth-Type MS-CHAP {
                mschap
        }
        Auth-Type LDAP {
                ldap
        }
        inner-eap
}

session {
        radutmp
}

post-auth {
        Post-Auth-Type REJECT {
                attr_filter.access_reject
        }
}

pre-proxy {
}

post-proxy {
        inner-eap
}
!EOF----------------------

modules/inner-eap:
!----------------------
eap inner-eap {
        default_eap_type = mschapv2
        timer_expire     = 60
        max_sessions = 2048
        mschapv2 {
         with_ntdomain_hack = yes
         use_mppe = no
         require_encryption = no
         require_strong = no
         authtype = MS-CHAPv2
        }

        tls {
                certdir = ${confdir}/certs
                cadir = ${confdir}/certs
                private_key_file = ${certdir}/newkey.pem
                certificate_file = ${certdir}/newcert.pem
                CA_file = ${cadir}/cacert.pem
                dh_file = ${certdir}/dh
                random_file = /dev/urandom
                fragment_size = 1024
                include_length = yes
                cipher_list = "DEFAULT"
        }
}
!EOF----------------------

modules/ldap:
!----------------------
ldap {
        server = "ldap://ldap.uriit.ru"
        identity = "cn=radius,ou=Services,dc=uriit,dc=local"
        password = "***"
        basedn = "ou=People,dc=uriit,dc=local"
        filter = "(&(objectclass=radiusprofile)(uid=%{Stripped-User-Name:-%{User-Name}}))"
        ldap_connections_number = 5
        timeout = 4
        timelimit = 3
        net_timeout = 1
        tls {
                start_tls = yes
                port = 389
                cacertfile              = /etc/openldap/ssl/cacert.pem
                certfile                = /etc/openldap/ssl/newcert.pem
                keyfile                 = /etc/openldap/ssl/newkey.pem
                require_cert    = "allow"
        }
        dictionary_mapping = ${confdir}/ldap.attrmap
        password_attribute = userPassword
        edir_account_policy_check = no
        set_auth_type = no
}
!EOF----------------------

modules/mschap:
!----------------------
mschap {
        use_mppe = no
        require_encryption = no
        require_strong = no
        with_ntdomain_hack = yes
}
!EOF----------------------

Лог аутентификации для пользователя vlan50 (из файла users) - Радиус вернул Accept:
http://pastebin.com/82AckCxU
Правда есть подозрение, что запрос обрабатывается несколько раз (несколькими модулями?)

Радиус - Лог аутентификации для пользователя vlan40 (из LDAP) - Радиус вернул Reject:
http://pastebin.com/LATPFvQv
Обращает на себя внимание следующий отрывок лога:
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Told to do MS-CHAPv2 for vlan40 with NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject

Как исправить ситуацию идей уже никаких нет.