I'm in the process of replacing my old radiusd 3.0.0 server with a newer version of freeradius 3.0.26. I'm having trouble getting radtest to work properly. My environment is: I have an ubuntu 22.04 container running Samba 4.15.13-Ubuntu which is my DC The domain is TESTDOMAIN.COM (TESTDOMAIN) I have an ubuntu 22.04 client running freeradius 3.0.26 It has the Samba 4.15.13-Ubuntu client installed winbind is running on the freeradius server: # ps -ef|grep win root 259 1 0 Jan25 ? 00:00:04 /usr/sbin/winbindd --foreground --no-process-group root 313 259 0 Jan25 ? 00:00:00 winbindd: domain child [RADIUS3-TEST] root 315 259 0 Jan25 ? 00:00:00 winbindd: domain child [TESTDOMAIN] root 327 259 0 Jan25 ? 00:00:00 winbindd: idmap child In mods-available/mschap I have defined: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -- challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} --domain=%{%{mschap:NT-Domain}:-TESTDO MAIN.COM}" I can successfully run an ntlm_auth authentication from the freeradius server to the Samba domain: # ntlm_auth --request-nt-key --domain=TESTDOMAIN --username=deang Password: mypassword NT_STATUS_OK: The operation completed successfully. (0x0) However, I'm unable to get radtest to authenticate successfully: # radtest -t mschap deang "mypassword" localhost 0 localsecret Sent Access-Request Id 20 from 0.0.0.0:59459 to 127.0.0.1:1812 length 131 User-Name = "deang" MS-CHAP-Password = "mypassword" NAS-IP-Address = 192.168.5.160 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "mypassword" MS-CHAP-Challenge = 0xf550d266d7fbdad0 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000545a7cd05f7ad1c88fad7aaf36963c6480f007bd04421261 Received Access-Reject Id 20 from 127.0.0.1:1812 to 127.0.0.1:59459 length 61 MS-CHAP-Error = "\000E=691 R=1 C=0ca03ab284c45180 V=2" (0) -: Expected Access-Accept got Access-Reject Part of the debug log from freeradius -X shows (full log attached): (0) Found Auth-Type = mschap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} --domain=%{%{mschap:NT-Domain}:- TESTDOMAIN.COM}: (0) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (0) mschap: --> --username=deang (0) mschap: mschap1: 70 (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=705afc537b41679b (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=1564af7eff18c01a21daaaf03a78f61de5802689cbb65a8b (0) mschap: ERROR: No NT-Domain was found in the User-Name (0) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-TESTDOMAIN.COM} (0) mschap: --> --domain=TESTDOMAIN.COM (0) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (0) mschap: External script failed (0) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (0) mschap: ERROR: MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # authenticate = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> deang (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (mschap: No NT-Domain was found in the User-Name): [deang/<via Auth-Type = mschap>] (from client localhost port 0) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 191 from 127.0.0.1:1812 to 127.0.0.1:56941 length 61 (0) MS-CHAP-Error = "\000E=691 R=1 C=970a944ede733eb6 V=2" Waking up in 3.9 seconds. (0) Cleaning up request packet ID 191 with timestamp +4 due to cleanup_delay was reached Ready to process requests I've searched for some explanation why the radtest isn't working but I can't find anything related to this particular test. I am attaching the full log if needed. Any help appreciated. thanks - Dean Guenther