Problem with LDAP and ntlm_auth
We use Novell eDirectory and DSFW (Directory Services for Windows) which is kind of a Windows domain inside an OU in eDirectory. I want to authenticate users using LDAP and Windows computers account using ntlm_auth. There is only computers accounts in the Windows domain. The computer authentication is working fine but the users authentication with LDAP fails if ntlm_auth is configured. If I don't use ntlm_auth the users authentication works. Is there a way to have both of them working together? We use PEAP. Working user authentication with LDAP debug (ntlm_auth not configured): http://www.cspi.qc.ca/sinfrmc/ldap_only.htm Working Windows computer account authentication: http://www.cspi.qc.ca/sinfrmc/mschap_only.htm User account getting rejected debug (with ntlm_auth configured): http://www.cspi.qc.ca/sinfrmc/mschap_and_ldap.htm Thanks, Robert.
On 05/05/11 15:17, Robert Mc Cready wrote:
We use Novell eDirectory and DSFW (Directory Services for Windows) which is kind of a Windows domain inside an OU in eDirectory. I want to authenticate users using LDAP and Windows computers account using ntlm_auth. There is only computers accounts in the Windows domain.
The computer authentication is working fine but the users authentication with LDAP fails if ntlm_auth is configured. If I don't use ntlm_auth the users authentication works. Is there a way to have both of them working together?
Yes. Something like this: authorize { ... if (User-Name !~ /^host\//) { update control { MS-CHAP-Use-NTLM-Auth := no } } ... }
It's working now. Thanks for the help. -----Message d'origine----- De : freeradius-users-bounces+robert-mccready=cspi.qc.ca@lists.freeradius.org [mailto:freeradius-users-bounces+robert-mccready=cspi.qc.ca@lists.freeradius .org] De la part de Phil Mayers Envoyé : 5 mai 2011 11:03 À : freeradius-users@lists.freeradius.org Objet : Re: Problem with LDAP and ntlm_auth On 05/05/11 15:17, Robert Mc Cready wrote:
We use Novell eDirectory and DSFW (Directory Services for Windows) which is kind of a Windows domain inside an OU in eDirectory. I want to authenticate users using LDAP and Windows computers account using ntlm_auth. There is only computers accounts in the Windows domain.
The computer authentication is working fine but the users authentication with LDAP fails if ntlm_auth is configured. If I don't use ntlm_auth the users authentication works. Is there a way to have both of them working together?
Yes. Something like this: authorize { ... if (User-Name !~ /^host\//) { update control { MS-CHAP-Use-NTLM-Auth := no } } ... } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________ Information provenant d'ESET NOD32 Antivirus, version de la base des signatures de virus 6097 (20110505) __________ Le message a été vérifié par ESET NOD32 Antivirus. http://www.eset.com __________ Information provenant d'ESET NOD32 Antivirus, version de la base des signatures de virus 6097 (20110505) __________ Le message a été vérifié par ESET NOD32 Antivirus. http://www.eset.com __________ Information provenant d'ESET NOD32 Antivirus, version de la base des signatures de virus 6097 (20110505) __________ Le message a été vérifié par ESET NOD32 Antivirus. http://www.eset.com
Robert Mc Cready wrote:
The computer authentication is working fine but the users authentication with LDAP fails if ntlm_auth is configured. If I don't use ntlm_auth the users authentication works. Is there a way to have both of them working together?
Upgrade Samba. See the comments in eap.conf. Alan DeKok.
participants (3)
-
Alan DeKok -
Phil Mayers -
Robert Mc Cready