darkblue wrote:

There two type of method to integrate freeradius with AD, ntlm_auth and ldap, with help by experts such as Alan DeKok and Nicolas Baradakis , I had been setup the 802.1x+freeradius+ntlm_auth+AD. and I wonder what are the advantage and disadvantage about ldap and ntlm_auth.LDAP sounds better than ntlm_auth, is that right?

They're totally different. You are unlikely to find LDAP against AD useful for 802.1x authentication. LDAP-the-protocol can do two things: 1. What it's supposed to - return *information*. This can include, subject to access control, user info, such as the plaintext password *or* various pre-crypted ones such as the NT or LM hashes, the digest HA1, etc. This information is then available to FreeRadius to use, and FreeRadius can then do all the authentication (using the plaintext or appropriate crypts) and authorisation (using e.g. group info) itself 2. What it's not really supposed to but is used for A LOT; It can act as an authentication server for PAP. You connect, optionally bind as a search user, search to find the user, then (re)bind using the username and plaintext password from the PAP request, getting an OK or failed. In this scenario, you're effectively proxying Radius+PAP to LDAP+SimpleBind Now, ActiveDirectory cannot be made to return any password hash information over LDAP. It cannot, as far as anyone knows, be done. Therefore, if you're talking to AD over LDAP, you CANNOT extract the NT or LM hashes (or for that matter, the Kerberos DES/3DES/AES keys, or even the plaintext password if you're using reversible encryption). Therefore, LDAP to AD can ONLY authenticate PAP requests. MS-CHAP requests can be authenticated via the "ntlm_auth" helper method. The ONLY other way of doing MS-CHAP is to have the NT or LM hash in a form you can get into the radius server. This is by design nearly impossible to do with AD. (This excludes such obvious methods as using a password change plugin to capture passwords and make a copy of the NT/LM hashes or even plaintext, and various similar things, but they're orthogonal to the discussion) This is such an FAQ I wonder if it should be added to the default config file above the LDAP module.