I am trying to configure a FreeRADIUS server to authenticate users to an access point using either their username, or the username in the NTDomain format (the one used by Windows, like domainusername). The normal auth with the username is working correctly, but instead the authentication with NTDomain is not working. It seems that FreeRADIUS is not handling well the “” character.

I am trying to authenticate using radtest.

radtest -t mschap domainusername password localhost 0 testing123

The result from the log is the sequent:

(1) ldap: Performing search in “OU=MYDOMAIN,dc=mydomain,dc=com” with filter “(sAMAccountName=domainalessandro.nessi)”, scope “sub”

As you can see there is no character.

If I try to use “” when using the radtest command, with this form:

radtest -t mschap "domainusername" password localhost 0 testing123

I get:

Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default

(0) authorize {
(0) [preprocess] = ok
(0) suffix: Checking for suffix after “@”
(0) suffix: No ‘@’ in User-Name = “domain?lessandro.nessi”, skipping NULL due to config.
(0) [suffix] = noop
(0) domain: Checking for prefix before “”
(0) domain: No ” in User-Name = “domain?lessandro.nessi”, skipping NULL due to config.

As you can see the has been replaced with ?, and in my username is missing an “a”

I tryied multiple things.

I have set

preprocess
suffix (for @ format, not working either, not cutting the part after @)
ntdomain

On the default configuration (under /etc/freeradius/3.0/sites-enabled/default)

I have also tryied to set with_ntdomain_hack = yes on the preprocess file. This seems to work when I try directly to connect to the access point (it’s removing the domain at the start” but then I have problem authenticating with EAP, I get:
rlm_eap: Identity does not math User-Name, setting from EAP Identity.