mschap

mschap

Validates passwords using the Microsoft Challenge-Handshake Authentication Protocol (MS-CHAP). MS-CHAP uses a challenge-response mechanism based on the NT password hash.

Basic Syntax

@execute {
    backend {
        name "USERS";
        query "FIND_USER";
    }

    mschap;
}

Result

The mschap action produces the following pipeline results:

• Accept: The challenge-response verification succeeds. Execution continues to the next action.
• Reject: Authentication failed. This occurs when:
  • The user was not found (reason: "No such user"). Ensure the preceding backend action populates the user context.
  • The response does not match (reason: "Incorrect password").
• Ignore: The request does not contain MS-CHAP credentials. This allows combining mschap with other authentication actions such as pap or mschapv2 in the same pipeline - the non-matching action is skipped.