Mikrotik login with chap

Question
1

I have troubles with configuring of winbox login for Mikrotik router via privacyidea ->freeradius->AD. I’ve got following error:

LDAPPasswordIsMandatoryError(‘password is mandatory in simple bind’,). It sound like password sent to AD is empty

In freeradius -x debug I’ve found that password sent in encrypted CHAP-Password field

$RAD_REQUEST{‘CHAP-Password’} = &request:CHAP-Password → ‘***’

in other experiment with PAP l2tp authorization I have following message
$RAD_REQUEST{‘User-Password’} = &request:User-Password → ‘***’
password send in non-encrypted user-password field and authentication WORKING

Is it possible to make it working with CHAP encrypted password?

2

No. If you do not send the password via RADIUS it can not be passed to AD.

4

is it possible to login with chap using token’s pin as password instead of using AD password?

5

Unfortunately not.
privacyIDEA needs to pin+otp to split them.