How about taking the username / realm and searching for them in AD using the fact it is an LDAP service... once you know the LDAP record it ought to be trivial to derive the 'username' that needs to be used to authenticate the session using the existing working method. Just an idea can't say it'll work for certain AD depends if enough information is in the AD record for the user. A. On 18/01/2019, 09:59, "Freeradius-Users on behalf of WAGHORN, Jason (NHS BORDERS) via Freeradius-Users" <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org on behalf of freeradius-users@lists.freeradius.org> wrote: Hi As I said - if I can get it working for the 95% then I can arrange the relocation of the 5% to the same AD container - that leaves the outstanding issue of making sure that it's attempting to authenticate against the correct AD container... which is the part I still cannot fathom. So - Kerberos/RADIUS realm is example.com, users are in a.example.com - everything I see looks like when user@example.com attempts to authenticate via RADIUS that it pushes that same user/example.com combination towards AD for authentication and not the desired user/a.example.com so it fails. I suppose I could republish the RADIUS realm to match the domain but I've couched it in terms of "example.com" because the realm is already embarrassingly long (and cumbersome for users to enter) and the container where the users live makes that even more embarrassingly long. Apologies if the terminology is incorrect - I am trying to learn here. Cheers Jason ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by sending them to phishing@sky.uk as attachments. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD