On Mar 23, 2020, at 8:30 AM, Gregorio Luján Carboneras <gregorio_lujan@anadat.es> wrote:.
Could you please give me any advice regarding how to configure freeradius 3 (PEAP-MSCHAP2), to works with multiple sub-domains via NTLM/SAMBA?
I need to authenticate users from multiple sub-domains in “User Principal Name (UPN)” format:
-Example:
user1@domain.com user2@it.domain.com user3@sales.domain.com
There are a number of things going on here. First is the above user name strings. These are just text strings. The goal is to figure out how to map these strings to whatever is in AD.
I have joined the freeradius to the active directory.
FreeRADIUS doesn't going AD. Samba joins AD. The distinction is important. FreeRADIUS gets names && MS-CHAP data, and passes it to ntlm_auth, which in turn passes it to winbind, which passes it to AD.
When I request the users informatation via “wbinfo” command, I don´t obtain the domain information (only usernames). And only appears users from the principal domain (domain.com)
-Example:
Freeradius# wbinfo –u | grep user user1
See the Samba and wbinfo documentation for how to join / query different domains.
Actually I don't really understand how the authentication between the freeradius and the AD is performed (via NTLM, SAMBA, Kerberos ... ???)
Samba. This is documented on my web site: http://deployingradius.com/documents/configuration/active_directory.html
Could someone please provide me with a link to documentation so I can understand it?
See above. What you will have to do is ensure that the AD server knows about all of the sub domains. That way you only need to have Samba join "domain.com", and Active Directory will take care of the rest. You *should* be able then to check that all of the users can authentication. *Don't* do this with PEAP. It's about 3 steps too soon. Instead, use ntlm_auth: ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password Do this for multiple users in each domain. Do NOT try to do anything with FreeRADIUS until that works. i.e. if ntlm_auth can't authenticate users for multiple sub-domains, then no amount of poking FreeRADIUS will make it work. If ntlm_auth works for multiple users in multiple subdomains, then that's the hard part done. The next step is to configure FreeRADIUS to pass the right domain information. That's pretty easy. In the default configuration, edit proxy.conf, and define all of the domains: domain.com { } it.domain.com { } sales.domain.com { } After that, PEAP *should* just work. If it doesn't, post the debug output here. Alan DeKok.