[Samba] My Windows RAS won't authenticate against Samba PDC; do I need radius

[Bill Tomlinson]

We're replacing an NT4 PDC with a samba PDC and after a bit of work
everything is working fine except that our VPN server won't
authenticate users against the domain.

We're using Windows 2003 Server Remote Access Service (RAS) as our VPN
server and it was working with our old NT4 PDC. The Windows 2003
Server is otherwise cooperating with the new Samba PDC (I can log in
using domain accounts, etc). And for various reasons, we don't wish to
change our VPN server at this time.

First, I just wanted to make sure that I'm not wasting a lot of time
going down a dead end.

RAS operates in two general modes for authentication: Windows
Authentication, and using a radius server. We had been using Windows
Authentication mode. Does anyone know if Windows Authentication in RAS
will operate with a Samba PDC (if I can just find the right
configuration)? If so, any pointers on the configuration.

Or, (as my reading seems to suggest) do I have to install a radius
server and have RAS authenticate against that?

I'm running Samba 3.0.4 with an LDAP backend on SLES 9.