When we first set up FR3 with winbind, we found that machine based auth didn't work through winbind, but it did work through ntlm-auth. To solve this, we differentiate the mechanisms for each kind of authentication. In the mschap module, we have a second section called mschap_host in which ntlm-auth is called instead of winbind. I'm not sure if that's been fixed since we first set it up, but it may be worth a try for you. # MSCHAP authentication. Auth-Type MS-CHAP { if (User-Name =~ /^host\//){ mschap_host } else{ mschap } } ________________________________ From: Freeradius-Users <freeradius-users-bounces+trinkleinj=cofc.edu@lists.freeradius.org> on behalf of Isaac Boukris <iboukris@gmail.com> Sent: Tuesday, March 27, 2018 12:05:47 PM To: Alex Sharaz Cc: FreeRadius users mailing list Subject: Re: Using machine auth from a remote eduroam site On Tue, Mar 27, 2018 at 6:51 PM, Alex Sharaz <alex.sharaz@york.ac.uk> wrote:
Well its getting better, I now get
Tue Mar 27 16:34:46 2018 : Auth: (24212) Login incorrect (Home Server says so):[host/dpslap001.its.york.ac.uk] (from client yorkcc port 178 cli 80-86-F2-E0-7D-24) Tue Mar 27 16:34:46 2018 : Auth: (24212) Login incorrect: [host/dpslap001.its.york.ac.uk] (from client yorkcc port 178 cli 80-86-F2-E0-7D-24)
That's not necessarily better. Debugging winbind daemon could give more insights. - List info/subscribe/unsubscribe? See https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradi...