From cc04d8abeaeea864157ae8c683d225a1867703c0 Mon Sep 17 00:00:00 2001
From: Tygozwolle <tygo.vanolsttygo@gmail.com>
Date: Mon, 27 Jul 2026 12:04:54 +0200
Subject: [PATCH] feat: enable MS-CHAP error reporting to improve
 authentication feedback on Windows and iOS

---
 radiuscontroller/raddb/mods-enabled/mschap | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/radiuscontroller/raddb/mods-enabled/mschap b/radiuscontroller/raddb/mods-enabled/mschap
index 747312e..f1204b0 100644
--- a/radiuscontroller/raddb/mods-enabled/mschap
+++ b/radiuscontroller/raddb/mods-enabled/mschap
@@ -2,4 +2,10 @@ mschap {
 	# Send MS-CHAP-Error with E=691 on authentication failure,
 	# so iOS / Windows show "Incorrect Password" instead of "Unable to join network".
 	send_error = yes
+
+	# Force the rejection format to return the MSCHAPv2 failure code
+	# (Error 691 explicitly maps to an incorrect password on iOS)
+	passchange {
+		ntlm_auth = "/usr/bin/ntlm_auth"
+	}
 }