From 563004ca54cb31d19e3bd9e30633c9f860070883 Mon Sep 17 00:00:00 2001 From: Daniel-Constantin Mierla Date: Sat, 30 Sep 2017 09:23:34 +0200 Subject: [PATCH] auth_radius: added section ids in docs --- .../auth_radius/doc/auth_radius_admin.xml | 101 +++++++++--------- 1 file changed, 51 insertions(+), 50 deletions(-) diff --git a/src/modules/auth_radius/doc/auth_radius_admin.xml b/src/modules/auth_radius/doc/auth_radius_admin.xml index fe47997e3f6..d7b4080d2db 100644 --- a/src/modules/auth_radius/doc/auth_radius_admin.xml +++ b/src/modules/auth_radius/doc/auth_radius_admin.xml @@ -8,22 +8,22 @@ ]> - + &adminguide; - +
Overview - This module contains functions that are used to perform authentication - using a Radius server. Basically the proxy will pass along the - credentials to the radius server which will in turn send a reply + This module contains functions that are used to perform authentication + using a Radius server. Basically the proxy will pass along the + credentials to the radius server which will in turn send a reply containing result of the authentication. So basically the whole - authentication is done in the Radius server. Before sending the request - to the radius server we perform some sanity checks over the - credentials to make sure that only well formed credentials will get to - the server. We have implemented radius authentication according to + authentication is done in the Radius server. Before sending the request + to the radius server we perform some sanity checks over the + credentials to make sure that only well formed credentials will get to + the server. We have implemented radius authentication according to draft-sterman-aaa-sip-00. This module requires the radiusclient-ng - library version 0.5.0 or higheer or freeradius-client which is available from + library version 0.5.0 or higheer or freeradius-client which is available from https://github.com/FreeRADIUS/freeradius-client/. You can also install this library from distribution repositories. @@ -38,7 +38,7 @@ extra queries. - The additional credentials are embedded in the RADIUS reply as AVPs + The additional credentials are embedded in the RADIUS reply as AVPs SIP-AVP. The syntax of the value is: @@ -81,7 +81,7 @@
Modules - The module depends on the following modules (in the other words + The module depends on the following modules (in the other words the listed modules must be loaded before this module): @@ -95,7 +95,7 @@
External Libraries or Applications - The following libraries or applications must be installed + The following libraries or applications must be installed before compilling &kamailio; with this module loaded: @@ -104,14 +104,14 @@ freeradius-client. - freeradius-client available from + freeradius-client available from https://github.com/FreeRADIUS/freeradius-client/. - radiusclient-ng 0.5.0 or higher -- - library and development files. See radiusclient-ng 0.5.0 or higher -- + library and development files. See http://developer.berlios.de/projects/radiusclient-ng/. @@ -122,14 +122,14 @@
Parameters -
+
<varname>radius_config</varname> (string) - This is the location of the configuration file of radius client + This is the location of the configuration file of radius client libraries. - Default value is + Default value is /usr/local/etc/radiusclient-ng/radiusclient.conf. @@ -139,12 +139,12 @@ modparam("auth_radius", "radius_config", "/etc/radiusclient.conf")
-
+
<varname>service_type</varname> (integer) - This is the value of the Service-Type radius attribute to be used. - The default should be fine for most people. See your radius client - include files for numbers to be put in this parameter if you need + This is the value of the Service-Type radius attribute to be used. + The default should be fine for most people. See your radius client + include files for numbers to be put in this parameter if you need to change it. @@ -157,13 +157,13 @@ modparam("auth_radius", "service_type", 15)
-
+
<varname>auth_extra</varname> (string) Semi-colon separated list of extra RADIUS attribute name=pseudo variable pairs. When radius_www_authorize() or radius_proxy_authorize() function is called, listed extra - attributes are included in RADIUS request with + attributes are included in RADIUS request with current values of corresponding pseudo variables. @@ -177,7 +177,7 @@ modparam("auth_radius", "auth_extra", "Acct-Session-Id=$ci")
-
+
<varname>use_ruri_flag</varname> (integer) When this parameter is set to the value other than "-1" and the @@ -237,17 +237,17 @@ modparam("auth_radius", "append_realm_to_username", 0)
Functions -
+
<function moreinfo="none">radius_www_authorize(realm [, uri_user])</function> - The function verifies credentials according to - RFC2617. If - the credentials are verified successfully then the function will - succeed and mark the credentials as authorized (marked credentials can + The function verifies credentials according to + RFC2617. If + the credentials are verified successfully then the function will + succeed and mark the credentials as authorized (marked credentials can be later used by some other functions). - If the function was unable to + If the function was unable to verify the credentials for some reason, it fails and assigns a WWW-Authorize header containing a new challenge to digest_challenge AVP (see modules/auth). @@ -271,7 +271,8 @@ modparam("auth_radius", "append_realm_to_username", 0) -4 (stale nonce) - stale nonce; - -2 (authorization failed) - RADIUS responded with Access Reject which may be, for example, due to user not found or wrong password; + -2 (authorization failed) - RADIUS responded + with Access Reject which may be, for example, due to user not found or wrong password; -1 (error) - some error occurred during authorization (see syslog); @@ -279,18 +280,18 @@ modparam("auth_radius", "append_realm_to_username", 0) This function will perform sanity checks over - the received + the received credentials and then pass them along to RADIUS - server which will + server which will verify the credentials and return whether they are valid or not. Meaning of the parameter is as follows: realm - Realm is a - opaque string that + opaque string that the user agent should present to the user so he - can decide what + can decide what username and password to use. In case of REGISTER requests it is usually hostpart of To URI. @@ -304,7 +305,7 @@ modparam("auth_radius", "append_realm_to_username", 0) present, will be given to Radius server as value of SIP-URI-User check item. If uri_user pseudo variable parameter is not - present, the server will generate + present, the server will generate SIP-URI-User check item value from user part of To/From URI. @@ -339,17 +340,17 @@ modparam("auth_radius", "append_realm_to_username", 0)
-
+
<function moreinfo="none">radius_proxy_authorize(realm [, uri_user])</function> - The function verifies credentials according to - RFC2617. If - the credentials are verified successfully then the function will - succeed and mark the credentials as authorized (marked credentials can - be later used by some other functions). + The function verifies credentials according to + RFC2617. If + the credentials are verified successfully then the function will + succeed and mark the credentials as authorized (marked credentials can + be later used by some other functions). - If the function was unable to + If the function was unable to verify the credentials for some reason, it fails and assigns a Proxy-Authorize header containing a new challenge to digest_challenge AVP. The script should @@ -358,15 +359,15 @@ modparam("auth_radius", "append_realm_to_username", 0) For negative result codes, see the above function. - This function will perform sanity checks over the received - credentials and then pass them along to RADIUS server which will + This function will perform sanity checks over the received + credentials and then pass them along to RADIUS server which will verify the credentials and return whether they are valid or not. Meaning of the parameters is as follows: - realm - Realm is a opaque string that - the user agent should present to the user so he can decide what + realm - Realm is a opaque string that + the user agent should present to the user so he can decide what username and password to use. In case of non-REGISTER requests it is usually hostpart of From or P-Preferred-Identity URI. @@ -381,7 +382,7 @@ modparam("auth_radius", "append_realm_to_username", 0) present, will be given to Radius server as value of SIP-URI-User check item. If uri_user pseudo variable parameter is not - present, the server will generate + present, the server will generate SIP-URI-User check item value from user part of To/From URI.