radius authentication

[jh]

For those who use Radius authentication of users in OpenSER, it would be critical to Radius authentication backend also for OpenXCAP.

By looking at the code, Radius authentication does not seem that difficult to add using pyrad. What confuses me is the organization of backend classes. Now database.py deals with both authentication and storage, whereas openser.py only deals with storage.

I'm not any expert on this, but should there be separate openser_storage.py and database_storage.py as well as database_authentication.py and radius_authentication.py or what?

-- Juha

[jh]

i did a radius authentication experiment using pyrad and got authentication working using the simple program below. thus in radius config, the following items seem to suffice:

class Config(ConfigSection):

radius_server = '127.0.0.1' secret = 'secret' dictionary = 'dictionary' service_type = null

if service_type is null, no Service-Type attribute will be added. User-Name and User-Password would get their values like in db authentication.

-- juha

---

import pyrad.packet from pyrad.client import Client from pyrad.dictionary import Dictionary

srv=Client(server="127.0.0.1", secret="secret",

dict=Dictionary("dictionary"))

req=srv.CreateAuthPacket(code=pyrad.packet.AccessRequest,

User_Name="foo@test.fi")

reqUser-Password?=req.PwCrypt("top_secret") reqService-Type?="Login-User"

reply=srv.SendPacket(req) if reply.code==pyrad.packet.AccessAccept:

print "access accepted"

else:

print "access denied"

print "Attributes returned by server:" for i in reply.keys():

print "%s: %s" % (i, reply[i])

[admin]

Hello Juha,

We'll try to integrate Radius authentication as soon as possible. Both openser.py and database.py deal with authentication, but openser.py just subclasses the authentication classes from database.py, so indeed we'll probably need some restructuring or refactoring of the code to support other authentication methods such as Radius or LDAP.

[jh]

Mircea,

i quick hack would be to write _query_radius function similar to _query_credentials that instead of db query would make radius query as in above and if query succeeds, would call _got_query_results with rows argument that would be the same as the credentials password, and if query fails, would call _got_query_results with null rows argument. that way the rest of the code could be left untouched.

but as you say, may be better to do some restructuring so that it is easy to copy with new auth methods later.

-- Juha

[admin]

Version 1.0 will be launched soon but it still does not have radius back-end as we had no resources to implement this feature.