Hi,
What I'm hoping to have might be a bit nonstandard(?) - it might be that I don't need that, that I don't need full domain name.
so ensure your realm is being handled
(2) suffix : Looking up realm "my.domain.local" for User-Name = "pe243@my.domain.local" (2) suffix : No such realm "my.domain.local"
add realm my.domain.local { strip } to proxy.conf now, when suffix runs, it will see your realm, know to deal with it locally but also populate p243 as Stripped-User-Name which then means that:
(2) mschap : Client is using MS-CHAPv1 with NT-Password Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (2) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (2) mschap : --> --username=pe243@my.domain.local
--username will now be the right value with no realm if, however, you do need to use the realm then you need to ensure that, on command line, ntlm_auth works with the realm - usually done by adding the realm as a UPN in AD alan