WARNING: No "known good" pasword found in LDAP

Question

I'm trying to get windows client (EAP-PEAP MSCHAPv2) to authenticate through freeRadius. I have eDirectory as user store. I've configured universal password and assigned the policy to respective OUs in eDir. I configured universal password policy to allow to retrieve cleartet password by users and "radmin" account, as per Novell docs. iManager RADIUS plugin is also installed, eDir RADIUS schema is extended, radius profile is applied to some users for testing (although no radius attributes are specified in that Radius profile, as Novell docs don't mention anything about it).
However, is looks like eDirectory is still not returning user's clear-text password in its LDAP reply to freeRadus server, the following warning appears in radius debug log: (WARNING: No "known good" password found in LDAP).
I followed this Novell guide to setup eDir and freeRadius: https://www.netiq.com/documentation/...ata/front.html
Here is my radius ldap config:
ldap TEST {
server = "192.168.1.1"
port = 636
identity = "cn=radmin,ou=USERS,o=TEST"
password = "password"
basedn = "ou=USERS,o=TEST"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
#base_filter = "(objectclass=radiusprofile)"
auto_header = yes
ldap_connections_number = 5
timeout = 4
timelimit = 3
net_timeout = 1
tls {
# start_tls = yes
tls_mode = yes
cacertfile = /etc/raddb/certs/test-tree.b64
dictionary_mapping = ${confdir}/ldap.attrmap
password_attribute = nspmPassword
edir_account_policy_check = no
set_auth_type = no
# access_attr = dialupAccess
keepalive {
idle = 60
probes = 3
interval = 3
#END
Any suggestions on fixing the problem are welcomed. Thanks in advance.

Answer 1

log doesn't seem display any errors, also I notices that the "nspm password" is is mentioned twice. As far as I know the n="nspm password" attribute is the clear text password. Also From the log i can see that all attributes are the request from radius, would be good to see actual eDir ldap reply in the log, including reply attributes. Any suggestions?
4269549312 LDAP: Work info status: Total:2 Peak:0 Busy:0
4211123968 LDAP: New TLS connection 0x8d5c00 from 192.168.1.52:54349, monitor = 0xffffffffe5102700, index = 1
3843041024 LDAP: Monitor 0xffffffffe5102700 initiating TLS handshake on connection 0x8d5c00
4205860608 LDAP: DoTLSHandshake on connection 0x8d5c00
4205860608 LDAP: BIO ctrl called with unknown cmd 7
4205860608 LDAP: Completed TLS handshake on connection 0x8d5c00
3821344512 LDAP: DoBind on connection 0x8d5c00
3821344512 LDAP: Bind name:cn=radmin,ou=USERS,o=TEST, version:3, authentication:simple
3821344512 AUTH: [000080c4] <.radmin.USERS.TEST.TEST-TREE.> LocalLoginRequest. Error success, conn: 8.
3821344512 LDAP: Sending operation result 0:"":"" to connection 0x8d5c00
4222703360 LDAP: DoSearch on connection 0x8d5c00
4222703360 LDAP: Search request:
base: "ou=USERS,o=TEST"
scope:2 dereference:0 sizelimit:0 timelimit:3 attrsonly:1
filter: "(uid=radmin)"
attribute: "nspmPassword"
attribute: "radiusNASIpAddress"
attribute: "radiusExpiration"
attribute: "acctFlags"
attribute: "userPassword"
attribute: "dBCSPwd"
attribute: "sambaNtPassword"
attribute: "sambaLmPassword"
attribute: "ntPassword"
attribute: "lmPassword"
attribute: "radiusCallingStationId"
attribute: "radiusCalledStationId"
attribute: "radiusSimultaneousUse"
attribute: "radiusAuthType"
attribute: "radiusCheckItem"
attribute: "radiusTunnelPrivateGroupId"
attribute: "radiusTunnelMediumType"
attribute: "radiusTunnelType"
attribute: "radiusReplyMessage"
attribute: "radiusLoginLATPort"
attribute: "radiusPortLimit"
attribute: "radiusFramedAppleTalkZone"
attribute: "radiusFramedAppleTalkNetwork"
attribute: "radiusFramedAppleTalkLink"
attribute: "radiusLoginLATGroup"
attribute: "radiusLoginLATNode"
attribute: "radiusLoginLATService"
attribute: "radiusTerminationAction"
attribute: "radiusIdleTimeout"
attribute: "radiusSessionTimeout"
attribute: "radiusClass"
attribute: "radiusFramedIPXNetwork"
attribute: "radiusCallbackId"
attribute: "radiusCallbackNumber"
attribute: "radiusLoginTCPPort"
attribute: "radiusLoginService"
attribute: "radiusLoginIPHost"
attribute: "radiusFramedCompression"
attribute: "radiusFramedMTU"
attribute: "radiusFilterId"
attribute: "radiusFramedRouting"
attribute: "radiusFramedRoute"
attribute: "radiusFramedIPNetmask"
attribute: "radiusFramedIPAddress"
attribute: "radiusFramedProtocol"
attribute: "radiusServiceType"
attribute: "radiusReplyItem"
attribute: "nspmPassword"
4222703360 AUTH: Starting SEV calculation for conn 8, entry .radmin.USERS.TEST.TEST-TREE..
4222703360 AUTH: 1 GlobalGetSEV.
4222703360 AUTH: 4 GlobalGetSEV succeeded.
4222703360 AUTH: SEV calculation complete for conn 8, (0:0 s:ms).
4222703360 LDAP: Sending search result entry "cn=radmin,ou=USERS,o=TEST" to connection 0x8d5c00
4222703360 LDAP: Sending operation result 0:"":"" to connection 0x8d5c00
4219545344 AUTH: UpdateLoginAttributesThread page 1 processed 1 login in 1 milliseconds