22 Jun
2017
22 Jun
'17
10:46 a.m.
Hi all, On Thu, Jun 22, 2017 at 4:11 PM Alan DeKok <aland@deployingradius.com> wrote:
Sending Access-Request of id 220 to 127.0.0.1 port 1812 User-Name = "alejandro@domain.com <alcabrera@g-bapro.net>"
Is the account in AD called "alejandro@domain.com"? Or is it just alejandro ?
Again... if you're testing a user in AD, you just need to test with the username that's in AD. There is simply no reason to do anything else.
Remember that AD has TWO usernames: the sAMAccountName (old style NetBios) and the userPrincipalName (new style, kerberos), the latest also includes the domain. BUT windbind (and ntlm_auth) uses the sAMAccountName username, so be sure to pass that name and not the new userPrincipalName. Cheers, Enrico