Unauthenticated users vs activated users
Hi all, on my system i completely disabled any kind of users authentication with passwords. However i still need to check if a specific URI is "enabled" to login (even if unauthenticated). So i still need to check if the user can REGISTER or not, checking if it's "username" is enabled to login or not. However when i disable authentication FS does not anymore make xml_curl lookup, reasonably, because there's no authentication to be done. However i need to check in a database if the user (checking only the login-name) is authorized to login with user/password. Is there some workaround and/or particular configuration with which this kind of logic could be implemented/enforced or does it require code modifications? If it required introducing a feature to FS i am available to provide financial support for consulting to implement such feature. Waiting for yours Fabio Pietrosanti
Yes, i am already using mod_xml_curl but mod_xml_curl act only when you configure it for a lookup for authenticating users. I am using it with xml_curl.conf with "directory" and "dialplan" succesfull with user authentication . If i completely disable FS authentication: internal_auth_calls=false users can log-in directly without authentication. But no query to mod_xml_curl is done because authentication is disabled. However i need to first check if they are *authorized* to log-in without authentication and this decision has to be made by querying a database (with mod_xml_curl). I need to check if a users is authorized to login without authentication by querying a database with mod_xml_curl. This does not seems to be possible, already made some discussion on #freeswitch channel and David said that it seems to be a feature requests. Fabio On 22/03/10 14.05, Brian West wrote:
Please see mod_xml_curl
/b
On Mar 22, 2010, at 7:39 AM, Fabio Pietrosanti (naif) wrote:
If it required introducing a feature to FS i am available to provide financial support for consulting to implement such feature.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
yes turn auth-calls = true.. the hint is to return an empty password if you want to let them in. So you do all your logic server side. /b On Mar 22, 2010, at 8:54 AM, Fabio Pietrosanti (naif) wrote:
Yes, i am already using mod_xml_curl but mod_xml_curl act only when you configure it for a lookup for authenticating users.
I am using it with xml_curl.conf with "directory" and "dialplan" succesfull with user authentication .
If i completely disable FS authentication: internal_auth_calls=false
users can log-in directly without authentication. But no query to mod_xml_curl is done because authentication is disabled.
However i need to first check if they are *authorized* to log-in without authentication and this decision has to be made by querying a database (with mod_xml_curl).
I need to check if a users is authorized to login without authentication by querying a database with mod_xml_curl.
This does not seems to be possible, already made some discussion on #freeswitch channel and David said that it seems to be a feature requests.
Fabio
That's true but the reason for which i am disabling authentication is that i am using SIP/TLS over a mobile channel. Mobile channel is extremely unreliable and the packet loss and high delay trigger TCP congestion control systems. This cause *a lot of problems* increasing the delay for calling exponentially. So i need to reduce the amount of packets (and SIP protocol steps) required in order to let the mobile clients to: a) register b) INVITE When authentication is enabled the clients always attempt to login without authentication, get a "407" proxy authentication required and then try to re-register with authentication using Digest authentication. The same happen when there is an INVITE. Removing authentication let me have 50% reduced time and 50% less bandwidth in order to let a mobile client register and make a call. So definitely i need to keep auth-calls=false . At the same time i need to check if the users logging-in are "authorized" to login (without authentication) or not. Could it be done with FS as-is or does it require a custom modification/patches/features in the code? Fabio Pietrosanti On 22/03/10 15.00, Brian West wrote:
yes turn auth-calls = true.. the hint is to return an empty password if you want to let them in. So you do all your logic server side.
/b
On Mar 22, 2010, at 8:54 AM, Fabio Pietrosanti (naif) wrote:
Yes, i am already using mod_xml_curl but mod_xml_curl act only when you configure it for a lookup for authenticating users.
I am using it with xml_curl.conf with "directory" and "dialplan" succesfull with user authentication .
If i completely disable FS authentication: internal_auth_calls=false
users can log-in directly without authentication. But no query to mod_xml_curl is done because authentication is disabled.
However i need to first check if they are *authorized* to log-in without authentication and this decision has to be made by querying a database (with mod_xml_curl).
I need to check if a users is authorized to login without authentication by querying a database with mod_xml_curl.
This does not seems to be possible, already made some discussion on #freeswitch channel and David said that it seems to be a feature requests.
Fabio
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Please pay close attention this time. On Mar 22, 2010, at 9:09 AM, Fabio Pietrosanti (naif) wrote:
When authentication is enabled the clients always attempt to login without authentication, get a "407" proxy authentication required and then try to re-register with authentication using Digest authentication.
The same happen when there is an INVITE.
Removing authentication let me have 50% reduced time and 50% less bandwidth in order to let a mobile client register and make a call.
You clearly do not get what I'm saying. I have told you what to do and you still don't listen.
So definitely i need to keep auth-calls=false .
No you want it to true. If you don't listen to me this time then I give up. The reason you want it set to true is then you CAN do the directory lookup. Just return an empty password. The 401/407 will never take place and it gives you a way to let them in or not depending on what you want.
At the same time i need to check if the users logging-in are "authorized" to login (without authentication) or not.
See Above.
Could it be done with FS as-is or does it require a custom modification/patches/features in the code?
See Above.
Fabio Pietrosanti
/b
bkw wishlist: http://www.amazon.com/gp/registry/wishlist/1BWDJUX5LYQE0 On Mon, Mar 22, 2010 at 3:27 PM, Brian West <brian@freeswitch.org> wrote:
Please pay close attention this time.
On Mar 22, 2010, at 9:09 AM, Fabio Pietrosanti (naif) wrote:
When authentication is enabled the clients always attempt to login without authentication, get a "407" proxy authentication required and then try to re-register with authentication using Digest authentication.
The same happen when there is an INVITE.
Removing authentication let me have 50% reduced time and 50% less bandwidth in order to let a mobile client register and make a call.
You clearly do not get what I'm saying. I have told you what to do and you still don't listen.
So definitely i need to keep auth-calls=false .
No you want it to true. If you don't listen to me this time then I give up.
The reason you want it set to true is then you CAN do the directory lookup. Just return an empty password. The 401/407 will never take place and it gives you a way to let them in or not depending on what you want.
At the same time i need to check if the users logging-in are "authorized" to login (without authentication) or not.
See Above.
Could it be done with FS as-is or does it require a custom modification/patches/features in the code?
See Above.
Fabio Pietrosanti
/b
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618
On 22/03/10 15.27, Brian West wrote:
Please pay close attention this time.
Reading very closely, let me answer to see my setup.
So definitely i need to keep auth-calls=false .
No you want it to true. If you don't listen to me this time then I give up.
The reason you want it set to true is then you CAN do the directory lookup. Just return an empty password. The 401/407 will never take place and it gives you a way to let them in or not depending on what you want.
I verified that it does not works properly that way (at least with my setup) 1 - Client -> REGISTER(unauth) -> Server 2 - Client <- 407/401 (send digest) <- Server 3 - Client -> REGISTER(digest auth) -> Server 4 - Client <- OK <- Server The FreeSWITCH configured with xml_curl.conf as follow: <binding name="directory"> <param name="gateway-url" value="http://XXX/directory" bindings="directory"/> <param name="auth-scheme" value="digest"/> </binding> <binding name="dialplan"> <param name="gateway-url" value="http://XXX/dialplan" bindings="dialplan"/> </binding> I verified with tcpdump in one hand and siptrace on the other one and with this setup FS make the xml_curl requests only AFTER the step "3", so after the unauth requests already failed. Maybe i am doing something wrong at the configuration, but FS does not make any kind of lookup on step "1" of the sip registration process. I need FS to make a lookup to a database on step "1" of authentication process, so i can check that THAT sip UA is enabled to login without authentication. Some ideas on how to tweak this situation? Fabio Pietrosanti
participants (3)
-
Brian West
-
Fabio Pietrosanti (naif)
-
Giovanni Maruzzelli