On Tue, 2019-10-29 at 09:39 +0100, Geaaru wrote:
there is an old issue in Gentoo bugzilla created before that i'm became Freeradius Ebuild Maintainer with (I think) a wrong dependency.
https://bugs.gentoo.org/662074
For some reason maybe in the past MSCHAP was related to Samba library?
It still is. If you build FreeRADIUS in the presence of the Samba libraries (specifically libwbclient), then rlm_mschap will link against it and enable you to authenticate directly against winbind, and therefore AD. If libwbclient isn't available, it won't link against it. The configure output is clear about what it's doing. In both cases, internal MSCHAP auth will work. It just affects externally authenticating against AD.
I think that is an error but can anyone confirm this.
If you depend on Samba, people who want to use direct winbind auth will be able to, and everyone gets an extra 15kb library. If you don't depend on Samba, useful functionality is lost for those who need it. I know which one I'd choose... -- Matthew