Shared secrets longer than 32 characters will be silently truncated to 32 characters.
Since only the password is encrypted in the Access-Request packet, this can appear in debugging logs (radiusd -xxx or -xxxx) as strange passwords.
Using a mostly-default configuration (enabling the rest
module, with method = post
and body = json
),
these can appear in the request body as a User-Password
of some 16-character/27-byte unicode string.