Sorry for the previous post. I have resolved this issue. It was the permission issue for the winbindd_privileged directory. --- Dennis Xu, MASc, CCIE #13056 Analyst 3, Network Infrastructure Computing and Communications Services(CCS) University of Guelph 519-824-4120 Ext 56217 dxu@uoguelph.ca www.uoguelph.ca/ccs ----- Original Message ----- From: "Dennis Xu" <dxu@uoguelph.ca> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Friday, September 11, 2015 12:06:41 PM Subject: FreeRadius and AD authentication I have installed FreeRadius 3.04 on RHEL7 and configured FreeRadius and Samba according to the following docs: http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOW... http://deployingradius.com/documents/configuration/active_directory.html Both wbinfo and ntlm_auth tests worked fine: [root@rotator mods-available]# wbinfo -a dxu001%xxxxxxx plaintext password authentication failed Could not authenticate user dxu001%xxxxxxxx with plaintext password challenge/response password authentication succeeded [root@rotator mods-available]# ntlm_auth --request-nt-key --domain=cfs.uoguelph.ca --username=dxu001 Password: NT_STATUS_OK: Success (0x0) [root@rotator mods-available]# When I tried to authenticate using username dxu001, the authentication failed. Below is the debug outputs: server inner-tunnel { (15) server inner-tunnel { (15) Request: EAP-Message = 0x020700411a0207003c31ea301dc50a02a3039d53ef8da042028d0000000000000000416ca750de3cd86e2f16a1533433d62264a5a1946f17c6c400647875303031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'dxu001' State = 0x20b8045120bf1e31a648ded5aa0c1cba Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '90-18-7c-17-97-6c' Called-Station-Id = '04-fe-7f-93-7c-a0:test-secure' NAS-Port = 1 Acct-Session-Id = '55f2fb67/90:18:7c:17:97:6c/97' NAS-IP-Address = 131.104.45.66 NAS-Identifier = 'WLC_TEST' Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Event-Timestamp = 'Sep 11 2015 12:05:06 EDT' (15) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (15) authorize { (15) [chap] = noop (15) [mschap] = noop (15) suffix : Checking for suffix after "@" (15) suffix : No '@' in User-Name = "dxu001", looking up realm NULL (15) suffix : No such realm "NULL" (15) [suffix] = noop (15) update control { (15) Proxy-To-Realm := 'LOCAL' (15) } # update control = noop (15) eap : Peer sent code Response (2) ID 7 length 65 (15) eap : No EAP Start, assuming it's an on-going EAP conversation (15) [eap] = updated (15) [files] = noop (15) [expiration] = noop (15) [logintime] = noop (15) [pap] = noop (15) } # authorize = updated (15) Found Auth-Type = EAP (15) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (15) authenticate { (15) eap : Expiring EAP session with state 0x20b8045120bf1e31 (15) eap : Finished EAP session with state 0x20b8045120bf1e31 (15) eap : Previous EAP request found for state 0x20b8045120bf1e31, released from the list (15) eap : Peer sent method MSCHAPv2 (26) (15) eap : EAP MSCHAPv2 (26) (15) eap : Calling eap_mschapv2 to process EAP data (15) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (15) eap_mschapv2 : Auth-Type MS-CHAP { (15) mschap : Creating challenge hash with username: dxu001 (15) mschap : Client is using MS-CHAPv2 Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (15) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (15) mschap : --> --username=dxu001 (15) ERROR: mschap : No NT-Domain was found in the User-Name (15) mschap : EXPAND --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} (15) mschap : --> --domain=CFS.UOGUELPH.CA (15) mschap : Creating challenge hash with username: dxu001 (15) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} (15) mschap : --> --challenge=43f96f7805c5bb5a (15) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (15) mschap : --> --nt-response=416ca750de3cd86e2f16a1533433d62264a5a1946f17c6c4 Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)' (15) mschap : External script failed (15) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001) (15) ERROR: mschap : MS-CHAP2-Response is incorrect (15) [mschap] = reject Any ideas? Thanks! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html