On Jun 3, 2016, at 3:24 PM, Shawn Wilson <swilson@acs.on.ca> wrote:
Hi, I'm trying to configure freeradius 2.x to authenticate users against 3 different domains in an active directory forest. Currently, I have the the proxy.conf file configure for each realm like so:
realm domain.name { auth_pool = my_auth_failover }
You only need the "auth_pool" if you're proxying the packets. i.e. it can be deleted from the "realm" configuration.
Then I can pass the domain to the ntlm_auth command by using the "-domain=%{realm}" parameter. Everything works fine as long User-Name is in the format <username>@<my.domain.name>.
HOWEVER, the big problem I'm encountering is that we need users to authenticate via alternate UPN suffixes. It turns out Ntlm_auth will not authenticate against these suffixes, only the actual domain names.
What does that mean? "actual domain name" ?
Soooo, my question is: How can I change the UPN suffixes to their corresponding domain names? I tried using preprocess and the hints file configured like this:
DEFAULT User-Name =~ "^([^@]+)@upnsuffix1.name" User-Name := %{1}@domain.name<mailto:%25%7b1%7d@domain.name>
But that seemed to break EAP because it detected that the user-name changed.
Don't modify the User-Name. Modify the arguments to ntlm_auth. And since you've been careful to not post any examples or debug output, that's the best answer I can give. Alan DeKok.