Samba
-----
-* Download Samba4 and apply patches for mechanism agnosticism
+* Download Samba4 and apply patches for mechanism agnosticism which are
+ available at http://www.padl.com/~lukeh/samba/
* Join Samba as a member server or domain controller (only tested former)
* Extract local service principal key to keytab (currently there do not
appear to be tools to do this, but you can get the cleartext password
* Add a mapping from the PAC RADIUS attribute to urn:mspac: in the file
/usr/local/etc/shibboleth/attribute-map.xml:
- <GSSAPIAttribute name="urn:ietf:params:gss-eap:radius-avp urn:x-radius:1679163525"
- id="urn:mspac:" binary="true"/>
+ <GSSAPIAttribute name="urn:ietf:params:gss:radius-attribute 26.25622.133"
+ id="urn:mspac:" binary="true"/>
FreeRADIUS
----------
For the client, the GSS EAP mechanism can be specified on the command line:
-smbclient --password samba --mechanism 1.3.6.1.4.1.5322.22.1.18 '\\host\share'".
+smbclient --password samba --mechanism 1.3.6.1.5.5.15.1.1.18 '\\host\share'".
There is no Moonshot SSPI implementation as yet, so it is not possible to test
with a Windows client.