MSCHAP using multiple domains

[Matthew Newton]

On 21/07/2020 17:01, Klemen forneci wrote:

> When I use mschap_thor everything works. When I try mschap_loki, I get
> the following error:
> (2) mschap_loki: ERROR: Program returned code (1) and output 'Logon
> Failure: The machine you are logging onto is protected by an
> authentication firewall. The specified account is not allowed to
> authenticate to the machine. (0xc0000413)'
> (2) mschap_loki: External script failed
> (2) mschap_loki: ERROR: External script says: Logon Failure: The
> machine you are logging onto is protected by an authentication
> firewall. The specified account is not allowed to authenticate to the
> machine. (0xc0000413)
> (2) mschap_loki: ERROR: MS-CHAP2-Response is incorrect
> 
> I've tried adding the radiusd server to the LOKI domain (net ads
> join), but the error remains. Are there any more settings in
> freeradius that i've missed or anywhere else. The whole project is on
> a standstill because of this :/

As you realise already I think - it's nothing to do with FreeRADIUS, 
which just runs the ntlm_auth binary and uses the result.

You need to run ntlm_auth manually with the same args, reproduce it 
there, and then debug back up through Samba.

Once ntlm_auth works, FreeRADIUS should work, too.

 From what I recall, you would normally link the domains together and 
then just join the FreeRADIUS server to one domain, the DC it sends its 
request to should forward to the other domain based on the --domain arg.

If you want to join to two distinct domains simultaneously I believe 
you'll need to have two separate isolated instances of Samba running 
(this may have changed since I looked last though).

-- 
Matthew