On Thu, Jan 29, 2015 at 03:54:52PM +0000, Rui Ribeiro wrote:
I would like to authenticate a guest domain in a different AD in FR3. I ... The ideia of having to mschap configurations is for calling ntlm_auth with a different Windows DOMAIN.
OK.
most specifically, this not works. Is it wiser to build a new FR to the guest domain.
You can do it all in one copy of FreeRADIUS. No need to run it twice. There are many ways to do this. You will need to make sure that the AD domains trust each other as your RADIUS server will (normally) only be joined to one domain, so will send all auth requests to that one. You could add something like --domain=%{Realm} to your existing ntlm_auth command line, but you probably want to do some sanity checks on the realm first in unlang. Another method similar to how we've done here in the past would be to define two instances of the mschap module. So in mods-available/mschap, copy the mschap { ... } section, and call it e.g. mschap domain2 { ... } Update the domain2 ntlm_auth one with your new domain. Then you need to use work out which one to use - either code this with if() in unlang, or use the call 'suffix' in authorize{} (which is enabled by default). Then you should be able to update your authenticate{} section from Auth-Type MS-CHAP { mschap } to something like Auth-Type MS-CHAP { if (Realm =~ /@my.second.realm$/) { domain2 } else { mschap } } If you can't get it working, post the full FreeRADIUS debug output (radiusd -X) to the list, otherwise nobody can tell what's going wrong. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>