[Freeswitch-users] Radius AAA
Tihomir Culjaga
tculjaga at gmail.com
Thu Nov 11 03:58:13 PST 2010
On Thu, Nov 11, 2010 at 8:27 AM, Abid Saleem <abid_freeswitch at live.com>wrote:
> Dear Tihomir,
>
> Good day. I am still waiting for your answer on the below subject. Could
> you please guide me further so I can fix this issue with mod_rad_auth. I
> hope you understand what is my problem.
>
>
>
Abid, i cannot write the dialplan for you. This part you should do by
yourself. I have explained how this module is supposed to work... and it
really does.
you need to evaluate the response from auth_function and act accordingly
(bridge or not bridge the call according to auth result)
again, here is an example:
module config:
<configuration name="rad_auth.conf" description="radius authentification
module">
<settings>
<!-- backward compatibility to allow radiusclient config file instead
of an embedded config -->
<param name="radius_config"
value="/usr/local/etc/radiusclient/radiusclient.conf"/>
</settings>
<client>
<param name="authserver" value="x.x.x.x:1812:gateway"/>
<param name="authserver" value="x.x.x.x:1812:gateway"/>
<param name="dictionary"
value="/usr/local/etc/radiusclient/dictionary.all"/>
<param name="seqfile" value="/var/run/radius.seq"/>
<param name="mapfile" value="/usr/local/etc/radiusclient/port-id-map"/>
<param name="default_realm" value=""/>
<param name="radius_timeout" value="2"/>
<param name="radius_retries" value="1"/>
<param name="radius_deadtime" value="60"/>
<param name="bindaddr" value="*"/>
</client>
<vsas>
<!--
name: just a description
value: direct input or variable
pec: vendor ID (0 for default, 9 for cisco...)
expr: 1 for channel variable, 2 for direct input
direction: in for radius-request, out for radius-response
-->
<!-- mappings for radius request message; input attributes -->
<param name="h323-conf-id" id="24" value="CALLID" pec="9" expr="1"
direction="in"/>
<param name="Calling-Station-Id" id="31" value="CALLINGNUMBER" pec="0"
expr="1" direction="in"/>
<param name="NAS-Port-Type" id="61" value="0" pec="0" expr="0"
direction="in"/>
<param name="NAS-Port-Id" id="87" value="ISDN 3/0:D:14" pec="0" expr="0"
direction="in"/>
<param name="Login-User" id="1" value="1" pec="0" expr="0"
direction="in"/>
<!-- mappings for radius-response message; output values from returning
outributes -->
<param name="CREDIT_AMOUNT" id="101" value="credit_amount" pec="9"
expr="0" direction="out"/>
<param name="CREDIT_TIME" id="102" value="credit_time" pec="9" expr="0"
direction="out"/>
<param name="RADIUS_RETURN_CODE" id="103" value="return_code" pec="9"
expr="0" direction="out"/>
<!-- expr param is to be ignored here-->
</vsas>
</configuration>
<extension name="RADIUS_ANI_AUTH">
<condition field="destination_number" expression="^RADIUS_ANI_AUTH$">
<action application="log" data="INFO Before Auth "/>
<action application="auth_function" data="in ${DIALED_NUMBER}, in
${USERNAME}, in ${PASSWD}, out AUTH_RESULT"/>
<action application="execute_extension" data="CHECK_IF_AUTORIZED XML
default"/>
</condition>
</extension>
<extension name="CHECK_IF_AUTORIZED">
<condition field="destination_number"
expression="^CHECK_IF_AUTORIZED$"/>
<condition field="${ANI_AUTH_RESULT}" expression="^NOK$">
<action application="log" data="INFO ################# Unauthorized -
reject call ################\n"/>
<action application="playback"
data="/path/to/file/your_call_is_not_authorized.wav"/>
<action application="playback"
data="/path/to/file/your_call_will_disconnect.wav"/>
<action application="hangup" data="CALL_REJECTED"/>
<anti-action application="log" data="INFO ################# Authorized
- let it go! ################\n"/>
<anti-action application="log" data="INFO ################# Radius
returned attributes - start ################\n"/>
<anti-action application="log" data="INFO
AUTH_RESULT=${AUTH_RESULT}"/>
<anti-action application="log" data="INFO
billing_model=${billing_model}"/>
<anti-action application="log" data="INFO
credit_amount=${credit_amount}"/>
<anti-action application="log" data="INFO currency=${currency}"/>
<anti-action application="log" data="INFO
preffered_lang=${preffered_lang}"/>
<anti-action application="log" data="INFO
credit_time=${credit_time}"/>
<anti-action application="log" data="INFO
h323_ivr_duration=${h323_ivr_duration}"/>
<anti-action application="log" data="INFO
return_code=${return_code}"/>
<anti-action application="log" data="INFO ################# Radius
returned attributes - end ################\n"/>
</condition>
</extension>
<extension name="Local_Extension">
<condition field="destination_number" expression="^(10[01][0-9])$">
<action application="set" data="dialed_extension=$1"/>
<action application="export" data="dialed_extension=$1"/>
<action inline="true" application="set"
data="CALLID=h323-conf-id=${uuid}"/>
<action inline="true" application="set"
data="CALLINGNUMBER=${caller_id_number}"/>
<action inline="true" application="set"
data="USERNAME=${caller_id_number}"/>
<action inline="true" application="set" data="PASSWD=1234"/>
<action inline="true" application="set"
data="DIALED_NUMBER=${dialed_extension}"/>
<action application="execute_extension" data="RADIUS_ANI_AUTH XML
default"/>
<!-- bind_meta_app can have these args <key> [a|b|ab] [a|b|o|s] <app>
-->
<action application="bind_meta_app" data="1 b s execute_extension::dx
XML features"/>
<action application="bind_meta_app" data="2 b s
record_session::$${recordings_dir}/${caller_id_number}.${strftime(%Y-%m-%d-%H-%M-%S)}.wav"/>
<action application="bind_meta_app" data="3 b s execute_extension::cf
XML features"/>
<action application="set" data="ringback=${us-ring}"/>
<action application="set" data="transfer_ringback=$${hold_music}"/>
<action application="set" data="call_timeout=30"/>
<!-- <action application="set"
data="sip_exclude_contact=${network_addr}"/> -->
<action application="set" data="hangup_after_bridge=true"/>
<!--<action application="set"
data="continue_on_fail=NORMAL_TEMPORARY_FAILURE,USER_BUSY,NO_ANSWER,TIMEOUT,NO_ROUTE_DESTINATION"/>
-->
<action application="set" data="continue_on_fail=true"/>
<action application="hash"
data="insert/${domain_name}-call_return/${dialed_extension}/${caller_id_number}"/>
<action application="hash"
data="insert/${domain_name}-last_dial_ext/${dialed_extension}/${uuid}"/>
<action application="set"
data="called_party_callgroup=${user_data(${dialed_extension}@${domain_name}
var callgroup)}"/>
<!--<action application="export"
data="nolocal:sip_secure_media=${user_data(${dialed_extension}@${domain_name}
var sip_secure_media)}"/>-->
<action application="hash"
data="insert/${domain_name}-last_dial/${called_party_callgroup}/${uuid}"/>
<action application="bridge" data="user/${dialed_extension}@
${domain_name}"/>
<action application="answer"/>
<action application="sleep" data="1000"/>
<action application="voicemail" data="default ${domain_name}
${dialed_extension}"/>
</condition>
</extension>
If you still have issues, contact me off the list and provide access to the
server... i don't know what to say to you anymore on this topic.
its more than clear.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20101111/b4db45e6/attachment-0001.html
More information about the FreeSWITCH-users
mailing list