[Freeswitch-users] ACL and Digest authentication problem

[katarina djakovic]

Dear FreeSwitch users,

we need some help about ACL and Digest authenication.  

This is what we want:

1) We want certain users to be authenticated through ACL (certain IP addresses) including both Register and Invite messages. In other words, we want those users to be granted access to our FS withouth having to authenticate with username and password when registering or calling.
2) On the other hand, if users don't fall into our ACL list (registering/calling from other IP addresses) we want them to authenticate normally throught Digest authentication (username/password).

We tried to configure FS for our needs, but we didn't acomplished what we wanted. Namely, now, for any users that do not belong to the ACL list our FS will reject their registration and will NOT fall back to Digest authentication. In other words, our FS will let all users that fall into ACL list register and call without authenticating --- but all others will be rejected on the attempt to register (debug trace says: sofia_reg.c IP YY.YY.YY.YY Rejected by register acl "domains") and will not let them fall back to Digest authentication.

These are our settings:

    a) acl.conf.xml: 
        <configuration name="acl.conf" description="Network Lists">
          <network-lists>

          <!--
        This will traverse the directory adding all users 
         with the cidr= tag to this ACL, when this ACL matches
        the users variables and params apply as if they 
        digest authenticated.
          -->
          <list name="domains" default="deny">
            <node type="allow" domain="$${domain}"/>
            <node type="allow" domain="XX.XX.XX.XX/32"/>
      
          </list>

          </network-lists>
        </configuration>

b) sip profile:

   <param name="apply-inbound-acl" value="domains"/>
   <param name="apply-register-acl" value="domains"/>
   <param name="auth-calls" value="true"/>

c) users that fall into ACL will have a cidr parameter set aproprietelly <user id="2000" mailbox="2000" cidr="XX.XX.XX.XX/32">

Other users, that we want to be authenticated through Digest authentication will not have anything related to ACL in their user profiles in the Directory.

2) On the other hand, if we remove the <param name="apply-register-acl" value="domains"/> from the sip profile, then users that do not belong to the ACL list will register normally and when calling - their calls (Invite) will fall back to digest authentication (here is the debug: "sofia.c:5847 IP YY.YY.YY.YY Rejected by acl "domains". Falling back to Digest auth.).

That is fine with us - but then we have a different problem, then the users from the ACL list will be asked to register by username/password credentials, i.e. their registration will have to authenticated and that is not what we wanted.


We are mistaging somewhere. Hopefully what I wrote makes sense and maybe someone could help us configure the system to fit our needs.

Many thanks in advance,
Katarina 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20101012/3972b809/attachment-0001.html