2fa radius challenge

[bergerf]

Hi!

I need some help for the radius/challenge setup.

My OpenVPN server is using radius for authentication. works fine.
The radius is now using an additional 2fa solution (PrivacyIDEA).

This is also working, for user without 2FA token or if the token is appended to the password.
This also works if the client is configured with "static-challenge" (<- but this works only for users with token...)

What I want is that the server is replying to the radius-challenge, which came if the user is having a token but is sending only the password.
So the 2nd Access-Request from OpenVPN should just contain the "state" attribute from the Challenge message.

I'm unable to bring this setup up, any hints?