<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7653.38">
<TITLE>Re: Beating a dead horse, or freeradius 2.1.1 and active directory</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>The how to lists the user account in bold indicating it should be modified to fit my environment. I created a user named rtest in active directory and am using that account for testing I do not think it will matter if I create a user called user to test with but I can.<BR>
<BR>
There is an entry in the users file that states (according to the how to this can be used for testing)<BR>
rtest Auth-type := "ntlm_auth"<BR>
<BR>
(Btw this fails unless ntlm_auth is inside quotes which is not shown in the how to)<BR>
<BR>
Which doesn't work using radtest.<BR>
<BR>
As far as the "warning" where exactly in the how to does it say to disable local auth because I sure didn't see it. This is enabled in the default install apparently because I sure didn't enable it.<BR>
<BR>
I appreciate the reply...<BR>
<BR>
---<BR>
Sent from Blackberry handheld device<BR>
<BR>
----- Original Message -----<BR>
From: freeradius-users-bounces+blittle=skylight.com@lists.freeradius.org <freeradius-users-bounces+blittle=skylight.com@lists.freeradius.org><BR>
To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org><BR>
Sent: Wed Dec 03 18:10:09 2008<BR>
Subject: RE: Beating a dead horse, or freeradius 2.1.1 and active directory<BR>
<BR>
>Rupert had mentioned in this thread that the switch is sending a PAP request and that it isn't being forwarded to the ntlm_auth module because of that, which makes sense I suppose. I am wondering though is there a way to configure the radius server to forward (or proxy) authentication requests to the KDC for authentication? I think what I'm doing is a little outside of the how-to that has been referenced.<BR>
><BR>
..<BR>
> Module: Instantiating ntlm_auth<BR>
> exec ntlm_auth {<BR>
> wait = yes<BR>
> program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=SKYLIGHT --username=%{mschap:User-Name} --password=%{User-Password}"<BR>
> input_pairs = "request"<BR>
> shell_escape = yes<BR>
> }<BR>
..<BR>
>rad_recv: Access-Request packet from host <switch> port 1645, id=46, length=84<BR>
> User-Name = "rtest"<BR>
> User-Password = "<omitted>"<BR>
> NAS-Port = 2<BR>
> NAS-Port-Id = "tty2"<BR>
> NAS-Port-Type = Virtual<BR>
> Calling-Station-Id = "<omitted>"<BR>
> NAS-IP-Address = +- entering group authorize {...}<BR>
..<BR>
>[files] users: Matched entry rtest at line 1<BR>
>++[files] returns ok<BR>
..<BR>
>Found Auth-Type = Local<BR>
>WARNING: Please update your configuration, and remove 'Auth-Type = Local'<BR>
<BR>
So, what happened to following the howto? Why is user entry for rtest<BR>
setting Auth-Type Local and not ntlm_auth? There is nothing like that<BR>
mentioned in the instructions. Debug is also printing a clear warning<BR>
that that is wrong.<BR>
<BR>
Ivan Kalik<BR>
Kalik Informatika ISP<BR>
<BR>
-<BR>
List info/subscribe/unsubscribe? See <A HREF="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A><BR>
</FONT>
</P>
</BODY>
</HTML>