[Serusers] SER+RADIUS+LDAP with encrypted passwords - sr-users

3 Jul 2005

Dear all,

I'm new in SER and i have a serius problem about implementing the authentication
system from LDAP;

SER<->freeRADIUS<->LDAP(user/pass(encrypted));

We have installed SER + Freeradius + LDAP system, the SER parts of configuration works
fine. 

if any SIP client coming into the SER the auth_radius modul forward the request correctly
to the freeradius:

the problem is the following:

rad_recv: Access-Request packet from host 127.0.0.1:50272, id=36, length=197
        User-Name = &quot;test(a)test.hu&quot;
        Digest-Attributes = 0x0a076779656269
        Digest-Attributes = 0x010d667265656d61696c2e6875
        Digest-Attributes =
0x022a34326337353933653330366534626363613836343837343332646635383363366139636364383038
        Digest-Attributes = 0x04117369703a667265656d61696c2e6875
        Digest-Attributes = 0x030a5245474953544552
        Digest-Response = "204aea65f72efb70b809ed425bec099c"
        Service-Type = Sip-Session
        Sip-Uri-User = "test"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 5060
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
  modcall[authorize]: module "preprocess" returns ok for request 4
  modcall[authorize]: module "chap" returns noop for request 4
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 4
    rlm_digest: Converting Digest-Attributes to something sane...
        Digest-User-Name = "test"
        Digest-Realm = "test.hu"
        Digest-Nonce = "42c7593e306e4bcca86487432df583c6a9ccd808"
        Digest-URI = "sip:test.hu"
        Digest-Method = "REGISTER"
rlm_digest: Adding Auth-Type = DIGEST
  modcall[authorize]: module "digest" returns ok for request 4
    rlm_realm: Looking up realm "test.hu" for User-Name = test(a)test.hu
    rlm_realm: No such realm "test.hu"
  modcall[authorize]: module "suffix" returns noop for request 4
    users: Matched entry DEFAULT at line 160
  modcall[authorize]: module "files" returns ok for request 4
  modcall[authorize]: module "mschap" returns noop for request 4
modcall: group authorize returns ok for request 4
  rad_check_password:  Found Auth-Type LDAP
auth: type "LDAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group Auth-Type for request 4
rlm_ldap: - authenticate
rlm_ldap: Attribute "User-Password" is required for authentication.
  modcall[authenticate]: module "ldap" returns invalid for request 4
modcall: group Auth-Type returns invalid for request 4
auth: Failed to validate the user.
Login incorrect: [test(a)test.hu/&lt;no User-Password attribute>] (from client localhost
port 5060)
Delaying request 4 for 1 seconds

so the ldap modul expect the "User-Password" attribute from radius client, but
because of DIGEST authentication only get "DIGEST-ATTRIBUTES" from the SIP
router,

Anyway, how to possible to authenticate the users with DIGEST authentication, if the
RADIUS can not see cleartext passwords in LDAP ?. 
I'm not expert in password math and calculations, and also read the sterman draft to
explain this to me.

So i suppose the following method:
Radius get the RADIUS request.-->Convert the DIGEST-ATTRIBUTES to readable
format.-->to calculate the DIGEST AUTH. values the RADIUS have to do LDAP lookup for
the PASSWORD-> Calculate the DIGEST AUTH. value and comapare it with the recieved one,
if match the user authenticated.

It's right ?

The radius authentication system works fine with DIGEST authentication, if I store the
user/pass on local file system (in users file) and also works authenticate from LDAP
without DIGEST auth (try with radtest).

Has anybody experience with this problem, DIGEST auth with LDAP ?

THX

Krisztián