I don't think my question has anything to do with freeradius, I think my problem is in using ntlm_auth and winbind, and with authorizing actual domain users instead of winbind-created users.