Documented ntlm_auth

diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
index dcd5883..4d9f1cf 100644 (file)
--- a/raddb/radiusd.conf.in
+++ b/raddb/radiusd.conf.in
@@ -680,21 +680,38 @@ $INCLUDE ${confdir}/eap.conf
                # if use_mppe is not set to no mschap will
                # add MS-CHAP-MPPE-Keys for MS-CHAPv1 and
                # MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2
-               #       use_mppe = no
+               #
+               #use_mppe = no
 
                # if mppe is enabled require_encryption makes
                # encryption moderate
-               #       require_encryption = yes
+               #
+               #require_encryption = yes
 
                # require_strong always requires 128 bit key
                # encryption
-               #       require_strong = yes
+               #
+               #require_strong = yes
 
                # Windows sends us a username in the form of
                # DOMAIN\user, but sends the challenge response
                # based on only the user portion.  This hack
                # corrects for that incorrect behavior.
-               #       with_ntdomain_hack = no
+               #
+               #with_ntdomain_hack = no
+
+               # The module can perform authentication itself, OR
+               # use a Windows Domain Controller.  This configuration
+               # directive tells the module to call the ntlm_auth
+               # program, which will do the authentication, and return
+               # the NT-Key.  Note that you MUST have "winbindd" and
+               # "nmbd" running on the local machine for ntlm_auth
+               # to work.  See the ntlm_auth program documentation
+               # for details.
+               #
+               # Be VERY careful when editing the following line!
+               #
+               #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
        }
 
        # Lightweight Directory Access Protocol (LDAP)