New User and AD Question

[Phil Mayers]

On 02/03/11 12:09, McNutt, Justin M. wrote:
>> These look like MS-CHAP machine-auth usernames; have you considered
>> using:
>>
>> %{mschap:User-Name} %{mschap:NT-Domain}
>>
>> The mschap module has special handling for host/ names, and these
>> will expand:
>>
>> host/name.domain.com
>>
>> to:
>>
>> name$ domain.com
>>
>> The trailing dollar sign on the hostname is intentional; SAM
>> account names for machines conventionally end in $ in windows.
>
> I'm aware of all of this.  The problem is, it doesn't seem to be
> actually working.  Here's the ntlm_auth command I'm using:
>
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
> --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain}
> --challenge=%{mschap:Challenge:-00}
> --nt-response=%{mschap:NT-Response:-00}"
>
> Note use of "%{mschap:User-Name}" and "%{mschap:NT-Domain}".  Despite
> this, "host/computer.domain" login attempts always fail.  Hence,
> trying to do the translation manually via a regex and update
> clauses.

In the most recent debug I see you posted (16:36 yesterday) it's failing 
because:

[eap] Request is supposed to be proxied to Realm $2.  Not doing EAP.
++[eap] returns noop

...then later:

WARNING: You set Proxy-To-Realm = $2, but the realm does not exist! 
Cancelling invalid proxy request.
No authenticate method (Auth-Type) configuration found for the request: 
Rejecting the user
Failed to authenticate the user.

You tried to use a regexp to parse the username (usually a mistake IMHO) 
and put the "domain" bit into the "Proxy-To-Realm" attribute but 
Proxy-To-Realm instructs the server to do just that - which cancels 
local authentiction.


Reading back through the thread, it seems like there is some confusion 
between "domain" in the Windows NT/Active Directory sense, and "domain" 
as a "Realm", which is a concept used in Radius proxying.

I'm going to take a guess and assume you don't really need to do 
proxying, and were just trying to use the "realm" module to strip off 
the "host/...domain.com" bits, and have gotten a bit tangled.


Don't set "Realm" or "Proxy-To-Realm" unless you want the radius packet 
to be sent to a different radius server.

Make sure you're using "%{mschap:User-Name}" everywhere that NT domain 
usernames might exist - in the "ldap" module filter, for starters.

At this point, you may find it easier to revert to the default configs 
and start from scratch, one change at a time and keeping the configs in 
version control.