May I only use rlm_ldap to authenticate against Active Directory? (without samba + winbind + ntlm_auth)

[Phil Mayers]

On 03/01/2010 09:14 AM, Tong Anh Quan wrote:
> Hi all,
>
> Can someone give me a confirmation?
>
> Details below:
> - In modules/ldap, I configures:
>
>
> - In modules/pap, I changed the auto_header option to "yes".
>
> - In eap.conf,
> + Set the default_eap_type = mschapv2 in peap section

No, sorry.

You cannot authenticate MS-CHAP against the AD LDAP server - only PAP.

You need to use Samba/winbind/ntlm_auth to authenticate MS-CHAP against AD.