--- /dev/null
+Notes on using Moonshot with Samba4.
+
+Samba
+-----
+
+* Download Samba4 and apply patches for mechanism agnosticism.
+* Join Samba as a member server or domain controller (only tested former):
+
+Shibboleth
+----------
+
+* Add to attribute-map.xml:
+
+ <GSSAPIAttribute name="urn:ietf:params:gss-eap:radius-avp urn:x-radius:1679163525"
+ id="urn:mspac:" binary="true"/>
+
+FreeRADIUS
+----------
+
+Install the rlm_mspac module and configure per below.
+
+* Create /usr/local/etc/raddb/modules/mspac with the following:
+
+ mspac {
+ keytab = /etc/krb5.keytab
+ spn = host/host.fqdn@KERBEROS.REALM
+ }
+
+* Add mspac to instantiate in radiusd.conf
+* Add mspac to post-auth in sites-enabled/inner-tunnel
+
+You will need to have a TGT for the host service principal before starting
+radiusd. It's possible to extract the password by editing secrets.ldb, which
+you can put in a keytab.
+
+Testing
+-------
+
+The Samba server doesn't require any specific command line arguments, although
+on OS X it was necessary to start it with -M single to function under gdb.
+
+For the client, the mechanism can be specified on the command line:
+
+smbclient --password samba --mechanism 1.3.6.1.4.1.5322.22.1.18 '\\host\share'".
+
+There is no Moonshot SSPI implementation as yet, so it is not possible to test
+with a Windows client.