Using ntlm_auth with AD subdomains

[Alan DeKok]

Dow, Corey wrote:
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{NT-Domain:-idmcorp.net} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"

  Where is the NT-Domain supposed to come from?

> The bottom line when I look at radiusd -X is that the challenge fails because only idmcorp.net is applied:
...
> WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{NT-Domain}

  So... there's no NT-Domain, and the idmcorp.net domain is used.  This
is what you configured.

> Sorry so wordy.  Can anyone think of a way to get this working for both the parent/child domains ?

  Step 1: get it working from the command line with the --domain
argument.  The tests you showed did *not* use the --domain argument...
yet you configured this in the mschap module.

  Step 2: Get the --domain=<foo> argument to expand properly for each
domain.  This involves configuring policy checks...

  Alan DeKok.