How do I decode the client password and compare it to the plain text password?
Except for PAP authentication it is impossible to decode the client password for a direct comparison to a local plain text or otherwise encoded password. PAP passwords are decoded using Authinfo.decode(byte[] password) or AuthInfo.getDecodedUserPassword(). The method employed is to perform the same encoding on the plain text password as the client used. The two encoded passwords are compared. If the encoding match the passwords match. There is a very slight chance that a different password will match but that is out of the scope of this document. All other passwords are sent as one-way hashes (encodings) that cannot be decoded. For MSCHAP & MSCHAP V1 the AuthInfo method cmpMSCHAP(byte[] password) encoded and compares the password to the MSCHAP Vendor-Specific attributes in the request packet. CHAP uses the cmpCHAP(byte[] plaintextPassword) method.
