Thanks Alan! The following code in the sites-available/inner-tunnel solved the problem. if ("%{sql: SELECT COUNT(*) FROM radcheck WHERE username = '%{SQL-User-Name}' AND pwdtype = 'local'}" > 0) { update control { MS-CHAP-Use-NTLM-Auth := 0 } } ffgch2 wrote:

...

I have set up Freeradius (v.2.1.10)

Upgrade to v2.2.0.

...

to do password authentication from MySQL database and it works fine but now I need to make some users be able to authenticate against Active directory accounts. I’ve setup winbind to authenticate windows accounts and it works but as a result freeradius lost ability to authenticate by local database.

You need to figure out when users will be checked against SQL, and when they will be checked against AD. Right now, you've configured FreeRADIUS to use both. Which isn't what you want.

...

So if I comment the line:

Don't randomly change things. It won't work.

...

Is there a way to tell mschap to use ntlm_auth depending on field in MySQL table and use the internal mechanisms if plain text passwords available in the MySQL table?

No. There are better ways.

See raddb/modules/mschap. You can control when ntlm_auth is called.

See "man unlang". You can configure policies. Read the debug output.

What you want is this:

authorize { ... sql if (ok) { update control { "MS-CHAP-Use-NTLM-Auth := No }

} ... }

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html