Dear Matthew and Alan, I take your advice and I will use my current succesful Freeradius platform for AUTHENTICATION (samba, winbind, ntlm_auth, mschapv2....according to Alan Dekok guide) and I will try to use LDAP for AUTHORIZATION as you said. I'm listing my current Debian packages installed in my Freeradius server, and I see freeradius-ldap is not present: freeradius 2.2.5+dfsg-0.2 freeradius-common 2.2.5+dfsg-0.2 freeradius-utils 2.2.5+dfsg-0.2 libfreeradius2 2.2.5+dfsg-0.2 When I go to /etc/freeradius/modules I can see the ldap file, so is it necessary to install freeradius-ldap or not??? Because maybe it's sufficient to edit my current /etc/freeradius/modules/ldap file, I can't understand the sense of having freeradius-ldap package. Thanks and maybe I will ask you again some questions about this topic....good bye !!! ADAM 2017-08-14 18:51 GMT-03:00 Alan Buxey <alan.buxey@gmail.com>:
+1 for Matthews answer , use the winbind module for the authentication , then, in inner-tunnel, use the ldap module against your AD for group checking.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html