Hi all, I've been on this list for a while, but I'm mostly just a lurker. But, I wanted to run a thought by folks here, before I spend too much time on the effort. Currently, I'm running Freeradius 3.0.13 (which I think was current when we installed) on RedHat Enterprise Linux 7 (7.6). I have a very simple implementation, using FreeRadius, Google Authenticator, and Linux. I create an account in Linux, and each Linux account has a Google Authenticator component, and I use FreeRadius as the backend to authenticate VPN users, coming from a Dell Sonicall TZ400. All this works with no issue. (The main reason I've been so quiet on this list. ;-)) Users come in from VPN, supply username, password, and Google auth OTP, and FreeRadius authenticates them. The users are defined in Linux, on the FreeRadius server itself. Since I first set this up a couple of years ago, we have made some changes, including moving to a Samba backend to do Active Directory authentication for Windows logins. So, my question is, instead of maintaining a separate database for VPN, is it possible (and how hard) to make my Samba server be the backend? So, when we add a user to the Samba AD server, they will gain VPN login access, in addition to the Windows domain for Windows login access. If I go that way, would the Google Auth stuff have to move over to the Samba server? Would two-factor auth apply to Windows domain login as well as VPN access? (That may be a Samba question, sorry.) Would the FreeRadius server need to move to the Samba server? Has anyone dome something like this? Was it difficult? I'm a little bit loathe to change a configuration that has been working so well for so long....but as we grow, I'm willing to bet it will pay for itself in time saved. Any helpful hints? Pointers to docs? All comments are much appreciated. Thanks, -Mark