Hi there Alex!

I was thinking of leaving Samba out of this entirely, and only using sssd-libwbclient as a backend for FreeRadius.

The problem I’m trying to solve here is a successful implementation of MS-CHAPv2 authentication in FreeRadius that DOES NOT use Samba’s ntlm_auth binary.

Since MS-CHAPv2 does not present clear text passwords, and instead gives us NtPasswordHash, I’m not able to use pam or krb5 authentication types.

-n

On Dec 10, 2021, at 11:08 AM, Alexey Tikhonov <atikhono@redhat.com> wrote:

Hi,

sssd-libwbclient was an "alternative" for winbinbd. It's not compatible with modern versions of Samba.

Or do you mean to keep smbd running with winbinbd and to use sssd-libwbclient only for FreeRADIUS? I'm not sure if the API is still compatible and if sssd-libwbclient implements everything required by FreeRADIUS.