On Jul 7, 2017, at 10:44 AM, Alejandro Cabrera Obed <aco1967@gmail.com> wrote:
Dear, I've implemented a Freeradius service that let authenticate users with PEAP/MSCHAPv2/NTLM against an Active Directory tree from a Windows Domain Controller server. In this scenario every user is authenticated developing a search from the root of the Active Directory tree.
Suppose my domain is "company.com", and now I need to authenticate users against some subtrees like these:
sales.company.com support.company.com
and not from the AD's root:
company.com
Is this possible to do this with my current implementation?
Yes. Just pass the subdomain to ntlm_auth. You can test this on the command-line with ntlm_auth, and a test user. Once that works, test it with radclient doing MS-CHAP against the "inner-tunnel" virtual server. See the comments at the top of "inner-tunnel" for more information. Once that works, PEAP should work. Alan DeKok.