Grrr...

 

This is probably a Samba issue - a known one? - but I can't seem to get AD authentications to hit multiple DCs.  Everything goes to the one listed in /etc/samba/smb.conf (which may be a coincidence).

 

I set up several mschap instances like so:

 

mschap mschap1 { ...

   ntlm_auth -s /etc/samba/radius.smb1.conf

}

 

mschap mschap2 { ...

  ntlm_auth -s /etc/samba/radius.smb2.conf

}

 

mschap mschap3 { ...

  ntlm_auth -s /etc/samba/radius.smb3.conf

}

 

I also disabled all PAP, CHAP, and references to "mschap" in all virtual servers listed in sites-enabled.  There is currently no "mschap { ... }" section in modules/mschap.

 

Added this to sites-enabled/campus-inner-tunnel where "mschap" was before:

 

redundant-load-balance {

        mschap1

        mschap2

        mschap3

}

 

Authentication *works*, but all authentications go to the same DC (the one specified in "mschap2").  Running "radiusd -X" shows that all mschap1/2/3 instances are being called, and no authentication *attempts* are being sent to the other two domain controllers.  (1 and 3 aren't failing.  They just aren't *tried*.)

 

Am I going about this all the wrong way?  Is this a known limitation in Samba?  Is there something about ntlm_auth that always references /etc/samba/smb.conf, regardless of the -s option?

 

Comments and criticisms welcome.

 

--J