As it's not happening every time, the only way I found to reproduce the issue is by changing the challenge parameter in the splash page url, so of course when I'm doing this I'm getting a wrong password.
Do you think the troubleshoot file will help in that case which is not really the same when it happens ? As I didn't understand yet why it's happening.
Would you be able to detail this decoding process before the rut sends the radius access-request. That could help me to better understand the process.
I'm not the dev of our software but our code (which is working most of the time) after the splash page is :
$hexchal = pack ("H32", $challenge);
$newchal = pack ("H*", md5($hexchal . $uamsecret));
$newpwd = pack("a32", $password);
$pappassword = implode ("", unpack("H32", ($newpwd ^ $newchal)));
Then we post the credentials that the RUT will use for the auth with $uamip:$uamport/logon?username=$username&password=$pappassword