<HTML><BODY><br>
<br>
<div class="js-helper js-readmsg-msg">
<style type="text/css"></style>
<div>
<base target="_self" href="https://e.mail.ru/">
<div id="style_14102941880000000621_BODY">
Hello, friends.<br>Ubuntu 14.04, freeradius 2.1.12+dfsg-1.1ubuntu0.1<br> I'm trying to authenticate a user through Active Directory(ntlm_auth) with option <span style="color: #000099;font-family: 'Times New Roman';font-size: 15px;background-color: #dde1c2;" data-mce-style="color: #000099;font-family: 'Times New Roman';font-size: 15px;background-color: #dde1c2;"><span style="color: #000099;font-family: 'Times New Roman';font-size: 15px;background-color: #dde1c2;" data-mce-style="color: #000099;font-family: 'Times New Roman';font-size: 15px;background-color: #dde1c2;">--require-membership-of.<br>When I run just from the console with the option --require-membership-of = 's-1-5-21-241991751-2423211274-3836920987-1626 - everything goes well.<br></span></span><p>root@lf-mgr-02:/etc/freeradius# ntlm_auth --request-nt-key --domain=lenfi.ru --username=test2 --require-membership-of='s-1-5-21-241991751-2423211274-3836920987-1626'<br>Password:<br>NT_STATUS_OK: Success (0x0)</p>When I add in mschap this option in debug I see:<br><p>Could not parse s-1-5-21-241991751-2423211274-3836920987-1626 into separate domain/name parts!<br>*** Error in `/usr/bin/ntlm_auth': free(): invalid pointer: 0x00007f13562b9e9c ***<br>Exec-Program output: ?▒t?▒r▒▒▒<???▒▒▒▒1▒?▒▒I?|$?H?▒??j▒▒▒▒▒r (0xc000000d)<br>Exec-Program-Wait: plaintext: ?▒t?▒r▒▒▒<???▒▒▒▒1▒?▒▒I?|$?H?▒??j▒▒▒▒▒r (0xc000000d)<br><br>When I try add --require-membership-of=LENFI\\wirelessusers:<br></p><p>Could not parse LENFILM\WirelessUsers into separate domain/name parts!<br>*** Error in `/usr/bin/ntlm_auth': free(): invalid pointer: 0x00007f13562b9e9c ***<br>Exec-Program output: ?▒t?▒r▒▒▒<???▒▒▒▒1▒?▒▒I?|$?H?▒??j▒▒▒▒▒r (0xc000000d)<br>Exec-Program-Wait: plaintext: ?▒t?▒r▒▒▒<???▒▒▒▒1▒?▒▒I?|$?H?▒??j▒▒▒▒▒r (0xc000000d)<br><br>Please tell me whether it is possible to add this option(--require-membership-of) in the config mschap to authenticate users of a AD group.<br>Thank you!</p><br><br><br><br>
</div>
<base target="_self" href="https://e.mail.ru/">
</div>
</div>
<br><hr>
<br>С уважением,<br>Попов Александр<br>pop5s@mail.ru<br></BODY></HTML>