Using machine auth from a remote eduroam site

Isaac Boukris iboukris at
Sat Mar 31 03:07:24 CEST 2018


On Fri, Mar 30, 2018 at 8:32 PM, Isaac Boukris <iboukris at> wrote:
>> On 27 March 2018 at 03:05, Isaac Boukris <iboukris at> wrote:
>>> On Mon, Mar 26, 2018 at 8:03 PM, Alex Sharaz via Freeradius-Users
>>> <freeradius-users at> wrote:
>>>>         winbind_username = "%{Stripped-User-Name}"
>>>>         winbind_domain = "ITS.YORK.AC.UK"
> BTW, the default configuration is:
> winbind_username = "%{mschap:User-Name}"
> This pulls out the first fqdn component and appends a dollar sign at
> the end - so it may help.

FYI, I've just tested machine authentication (with samba git master)
using the default config of:
        winbind_username = "%{mschap:User-Name}"
        winbind_domain = "%{mschap:NT-Domain}"

And it worked ok for both a computer from the local domain and one
from a child domain.

I think it should work fine as long as DNS suffix of the machine
matches its domain (like: HOST/ as that's
how 'mschap:NT-Domain' guesses the domain name.
Otherwise, if you have mapping knowledge from DNS suffix to domain
names, then you can set 'winbind_domain' manually instead of  using
'mschap:NT-Domain', however leave 'winbind_username' set to

Otherwise, the only way I can think of to reliably lookup machine's
name and domain from its service-principal is using global catalog
service (in local domain).

Example on my lab machine member of domain ACME.COM, and looking up a
service from child domain CDOM.ACME.COM, coming with DNS suffix of

$ ldapsearch -h -D administrator at ACME.COM -p 3268
servicePrincipalName=HOST/ sAMAccountName
distinguishedName msDS-PrincipalName canonicalName -W
# LDAPv3
# base <> (default) with scope subtree
# filter: servicePrincipalName=HOST/
# requesting: sAMAccountName distinguishedName msDS-PrincipalName canonicalName

dn: CN=IEWIN7C,CN=Computers,DC=CDOM,DC=acme,DC=com
distinguishedName: CN=IEWIN7C,CN=Computers,DC=CDOM,DC=acme,DC=com
sAMAccountName: IEWIN7C$
msDS-PrincipalName: CDOM\IEWIN7C$


More information about the Freeradius-Users mailing list