query mschap with ntlm_auth samba4

[Nicolás Lopiano]

  Hello! Sorry for the inconvenience.
I have been looking for information for a long time and could not find to
solve the problem I am running into.
My scenario is a vm with freeradius 3.0.17 joined to a samba4 domain with
sssd, samba version 4.9.5-Debian.
I need to get mschap to work via ntlm_auth. When making the query for
ntlm_auth I have no problem and it works. But when making the query using
mschap it gives me the following error:

Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: Program returned code (1) and
output 'The attempted logon is invalid. This is either due to a bad
username or authentication information. (0xc000006d) '
Wed Apr 7 11:06:35 2021: Debug: (3) mschap: External script failed
Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: External script says: The
attempted logon is invalid. This is either due to a bad username or
authentication information. (0xc000006d)
Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: MS-CHAP2-Response is incorrect

Next I copy how I have the config files:

cat /etc/samba/smb.conf
[global]
    workgroup = DOMAIN
    netbios name = RADIUS
    realm = DOMAIN
    security = ads
    password server = DC.DOMAIN
    ntlm auth = mschapv2-and-ntlmv2-only
    winbind use default domain = no

/etc/freeradius/3.0/sites-enabled/default

authorize {
        chap
        mschap
        preprocess
        suffix


        eap {
                ok = return
                updated = return
        }



        ldap
        expiration
        logintime
authenticate {

       Auth-Type MS-CHAP {
              mschap
        }


Auth-Type ntlm_auth {
                ntlm_auth
        }

Auth-Type eap {
      eap {
         handled = 1
      }
      if (handled && (Response-Packet-Type == Access-Challenge)) {
         attr_filter.access_challenge.post-auth
         handled # override the "updated" code from attr_filter
      }
   }


}

/etc/freeradius/3.0/mods-enabled/mschap

mschap {



with_ntdomain_hack = yes

ntlm_auth = "/ usr / bin / ntlm_auth --allow-mschapv2 --request-nt-key
--username =% {% {Stripped-User-Name}: -% {% {User-Name}: - None}} --domain
=% {% {mschap: NT-Domain}: - MYDOMAIN} --challenge =% {% {mschap:
Challenge}: - 00} --nt-response =% {% { mschap: NT-Response}: - 00} "

        pool {
                start = $ {thread [pool] .start_servers}

                min = $ {thread [pool] .min_spare_servers}

                max = $ {thread [pool] .max_servers}

                spare = $ {thread [pool] .max_spare_servers}

                uses = 0

                retry_delay = 30

                lifetime = 86400

                cleanup_interval = 300

                idle_timeout = 600

        }




}



I have tried several clients to check the service. He eapol_test and also
radtest -t mschap.

I can't find what the problem is

any suggestion? Thanks a lot!

Greetings.