Windows RRAS / PPTP + NPS + FreeRADIUS / privacyIDEA (MS-CHAPv2): Reprompt on failed attempt causes persistent auth failure

Question
1

Hi everyone,

We are facing an issue with Windows RRAS/PPTP clients authenticating against FreeRADIUS with privacyIDEA using MS-CHAPv2, where Windows NPS (Network Policy Server) acts as the RADIUS client / proxy.

Environment

  • VPN Server: Windows Server Routing and Remote Access (RRAS) - PPTP

  • RADIUS Client / Proxy: Windows NPS (pointing to upstream FreeRADIUS)

  • RADIUS Backend: FreeRADIUS 3.x with privacyIDEA plugin (rlm_privacyidea)

  • Client: Native Windows 10/11 VPN Client (PPTP)

  • Auth Protocol: MS-CHAPv2 (backed by privacyIDEA)

The Problem

  1. A user connects via native Windows PPTP and enters incorrect credentials on the first try.

  2. Windows displays a secondary credential prompt within the same session dialog.

  3. The user enters the correct credentials this time, but authentication fails again (Access-Reject).

  4. The user must manually cancel the prompt and initiate a brand new PPTP connection attempt for valid credentials to be accepted.

Observations

Windows RRAS/NPS and the native client reuse the initial MS-CHAPv2 challenge context during the retry prompt, but the upstream FreeRADIUS / privacyIDEA state is already consumed or invalid for that specific session attempt.

Attempting to enforce MaxDenials = 1 on the client registry breaks the initial logon dialog entirely because Windows attempts an unauthenticated/cached probe first.

Questions

  1. How should we configure FreeRADIUS / rlm_privacyidea (or NPS proxy settings) to ensure MS-CHAP-Error is returned with R=0 (Retry Not Allowed) instead of R=1, forcing RRAS/Windows to terminate the PPP session immediately on the first bad attempt?

  2. Is there a recommended unlang snippet in Post-Auth-Type REJECT (or a specific NPS Remote RADIUS Server group setting) to rewrite this attribute cleanly through the NPS proxy?

2

Thank you for your detailed description.

The privacyIDEA FreeRADIUS Plugin and the privacyIDEA Server do not support MSChapV2.
This is due to the handling of non-predictive OTP values and especially combinations of static secrets (passwords) and OTP values.
You need to go with PAP.

However, another problem might arise, if the NPS is trying to impersonate the user using the given password.