anchor.diff:  		StateData) ->
   	{stop, {shutdown, SessionID}, StateData};
   server_passthrough({accept, #subscriber{name = Identity,
  -		attributes = Attributes}, SslSocket}, #statedata{eap_id = EapID,
  +		attributes = Attributes, password = Password},
  +		SslSocket}, #statedata{eap_id = EapID,
   		start = #radius{}, session_id = SessionID, secret = Secret,
   		req_auth = RequestAuthenticator, radius_fsm = RadiusFsm,
   		radius_id = RadiusID, %ssl_socket = SslSocket,
  -		client_rand = ClientRandom, server_rand = ServerRandom}
  -		= StateData) ->
  -	Seed = [<<ClientRandom/binary, ServerRandom/binary>>],
  -	{MSK, _} = prf(SslSocket, master_secret ,
  -			<<"ttls keying material">>, Seed, 128),
  -	UserName = binary_to_list(Identity),
  -	Salt = crypto:rand_uniform(16#8000, 16#ffff),
  -	MsMppeKey = encrypt_key(Secret, RequestAuthenticator, Salt, MSK),
  -	Attr1 = radius_attributes:store(?UserName, UserName, Attributes),
  -	VendorSpecific1 = {?Microsoft, {?MsMppeSendKey, {Salt, MsMppeKey}}},
  -	Attr2 = radius_attributes:add(?VendorSpecific, VendorSpecific1, Attr1),
  -	VendorSpecific2 = {?Microsoft, {?MsMppeRecvKey, {Salt, MsMppeKey}}},
  -	Attr3 = radius_attributes:add(?VendorSpecific, VendorSpecific2, Attr2),
  -	EapPacket = #eap_packet{code = success, identifier = EapID},
  -	send_response(EapPacket, ?AccessAccept,
  -		RadiusID, Attr3, RequestAuthenticator, [], Secret, RadiusFsm, StateData),
  -	{stop, {shutdown, SessionID}, StateData};
  +		client_rand = ClientRandom, server_rand = ServerRandom,
  +		service_type = ServiceType} = StateData) ->
  +	case ocs:authorize(ServiceType, Identity, Password) of
  +		{ok, #subscriber{}} ->
  +			Seed = [<<ClientRandom/binary, ServerRandom/binary>>],
  +			{MSK, _} = prf(SslSocket, master_secret ,
  +					<<"ttls keying material">>, Seed, 128),
  +			UserName = binary_to_list(Identity),
  +			Salt = crypto:rand_uniform(16#8000, 16#ffff),
  +			MsMppeKey = encrypt_key(Secret, RequestAuthenticator, Salt, MSK),
  +			Attr1 = radius_attributes:store(?UserName, UserName, Attributes),
  +			VendorSpecific1 = {?Microsoft, {?MsMppeSendKey, {Salt, MsMppeKey}}},
  +			Attr2 = radius_attributes:add(?VendorSpecific, VendorSpecific1, Attr1),
  +			VendorSpecific2 = {?Microsoft, {?MsMppeRecvKey, {Salt, MsMppeKey}}},
  +			Attr3 = radius_attributes:add(?VendorSpecific, VendorSpecific2, Attr2),
  +			EapPacket = #eap_packet{code = success, identifier = EapID},
  +			send_response(EapPacket, ?AccessAccept,
  +				RadiusID, Attr3, RequestAuthenticator, [], Secret, RadiusFsm, StateData),
  +			{stop, {shutdown, SessionID}, StateData};
  +		{disabled, _} ->
  +			EapPacket = #eap_packet{code = failure, identifier = EapID},
  +			send_response(EapPacket, ?AccessReject, RadiusID,
  +					[], RequestAuthenticator, [], Secret, RadiusFsm, StateData),
  +			{stop, {shutdown, SessionID}, StateData};
  +		{error, _Reason} ->
  +			EapPacket = #eap_packet{code = failure, identifier = EapID},
  +			send_response(EapPacket, ?AccessReject, RadiusID,
  +					[], RequestAuthenticator, [], Secret, RadiusFsm, StateData),
  +			{stop, {shutdown, SessionID}, StateData}
  +	end;
   server_passthrough(reject, #statedata{eap_id = EapID, 
   		session_id = SessionID, secret = Secret, start = #radius{},
   		req_auth = RequestAuthenticator, radius_fsm = RadiusFsm,
  
positive.code: 		undefined ->
  			{stop, ocs_diameter_auth_port_server_not_found};
  		PortServer ->
  			StateData = #statedata{sup = Sup, server_address = ServerAddress,
  					server_port = ServerPort, client_address = ClientAddress,
  					client_port = ClientPort, session_id = SessionID,
  
negative.code: -include_lib("diameter/include/diameter.hrl").
  -include_lib("diameter/include/diameter_gen_base_rfc6733.hrl").
  -include("../include/diameter_gen_eap_application_rfc4072.hrl").
  -include("../include/diameter_gen_nas_application_rfc7155.hrl").
  
  -record(statedata,
  		{sup :: pid(),
  