Hi all, I am using freeradius 3.0.15. Samba version is 4.6.7. I compile both software on a Debian 9 machine. With nmbd and winbindd running flawlessly at the background, the domain user identification is working with using tools like wbinfo and id. However, when try to configure it with freeradius, it cannot authenticate. First of all, this configuration file: /usr/local/freeradius/etc/raddb/mods-enabled/mschap =============== winbind_username = “%{schap:User-Name}” winbind_domain = “SAMBADOM” #ntlm_auth = blahblahblah ============== Authentication was test using radtest =============== /usr/local/freeradius/bin/radtest -t mschap a_user thepassword 127.0.0.1 0 testing123 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 (0) No reply from server for ID 191 socket 3 =================== log.winbindd (in log level 10) =================== [2017/08/29 15:03:44.139816, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn INTERFACE_VERSION [2017/08/29 15:03:44.141735, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:395(winbindd_interface_version) [25579]: request interface version (version = 28) [2017/08/29 15:03:44.143656, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:INTERFACE_VERSION]: delivered response to client [2017/08/29 15:03:44.145639, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2017/08/29 15:03:44.147727, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:428(winbindd_priv_pipe_dir) [25579]: request location of privileged pipe [2017/08/29 15:03:44.150965, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2017/08/29 15:03:44.153161, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:919(new_connection) accepted socket 27 [2017/08/29 15:03:44.155338, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:968(winbind_client_request_read) closing socket 25, client exited [2017/08/29 15:03:44.157538, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:734(process_request) process_request: Handling async request 25579:GETGROUPS [2017/08/29 15:03:44.159669, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:60(winbindd_getgroups_send) getgroups freerad [2017/08/29 15:03:44.162646, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'SAMBADOM' name : * name : 'FREERAD' flags : 0x00000008 (8) [2017/08/29 15:03:44.171620, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.180970, 5, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:235(winbindd_getgroups_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.183154, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:796(wb_request_done) wb_request_done[25579:GETGROUPS]: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.192083, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:GETGROUPS]: delivered response to client ============== When I switch back using ntlm_auth instead, it is working flawlessly. Hope someone would help. Thanks for attending. Kinglok, Fong