On Jun 16, 2016, at 8:19 AM, Zenon Matuszyk <zenon.matuszyk@networkers.pl> wrote:
Hello,
I have a little problem with auth in Windows AD by using userPrincipalName (using samAccountName works fine). In mschap file i have:
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
and ldap file:
filter = "(userPrincipalName=%{%{Stripped-User-Name}:-%{User-Name}})"
In debug I see:
...
[mschap] Creating challenge hash with username: aa.aa@stud.wcc.domain.pl [mschap] Told to do MS-CHAPv2 for aa.aa@stud.wcc.domain.pl with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{User-Name} -> aa.aa@stud.wcc.domain.pl [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name}} -> --username=aa.aa@stud.wcc.domain.pl [mschap] Creating challenge hash with username: aa.aa@stud.wcc.domain.pl [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=1282528812d8f6bb [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=484795e959127ad898fd4230c3e3f52cbd19297d084e00d5 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d)
That seems definitive. The name / password is incorrect. Alan DeKok.