[SR-Users] RADIUS authentication

Thu Dec 20 23:34:39 CET 2012

I thanks for the responses. However, I still don’t have a “vision”
on how I can address my problem. My key points here are: - Most of the enterprise companies have a directory service
implemented already. So it does not make sense to create and maintain a second
one just for SIP clients. With this in mind, we may use LDAP or RADIUS to prevent
introducing a new directory just for SIP. - As long as I understood from my readings (sorry if I am wrong),
Kamailio LDAP will require a change on the customer’s LDAP schema, what most of
the times is “undesirable” on large enterprise. So the way out is to use the native operation
system RADIUS services from the customer’s environment, most of the time M$. Sorry if I am bugging the community of a “carrier product”
trying to adapt it to the enterprise environment. But why not? Kamailio is very
stable, very low foot print, very scalable and it is a product that could
become the “de facto” standard for “the SIP server” like we have a “de facto”
standard for DNS, DHCP, SQL, HTTP, etc. in most of Linux distro. By other hand, most (or all) SIP-PBX servers out there will solve the SIP issues but will also interfere on the RTP, what Kamailio does not do... So my next question is: is it there on the Kamailio
community anyone willing to work on a “Kamailio Enterprise Edition”? I believe the
enterprise market is just thousands times larger than the carrier one. So, does
it worth to create a thread just to discuss using Kamailio on the enterprise? As the last question, am I on the right forum? I mean, am I
asking the right thing on the wrong place? Think about it: thousands and thousands of enterprise
companies using Kamailio! Why not? Cheers! Moacir Date: Thu, 20 Dec 2012 18:29:55 +0100
From: miconda at gmail.com
To: moacirferreira at hotmail.com
CC: sr-users at lists.sip-router.org
Subject: Re: [SR-Users] RADIUS authentication

    On 12/20/12 3:58 PM, Moacir Ferreira
      wrote:

        Yeah... I know it can be a kind of problem. But millions of
        companies are using MS meaning we need to "adapt" if willing to
        work for the enterprise market. If we do not offer some kind of
        integration with AD, then we will end-up having 2 user names and
        2 passwords while the "good sense" is forwarding everyone to
        "single sign-on".

    There is no need for two usernames, but could be the case for two
    passwords...

        Anyway, it is tricky but M$ (I liked the $ thing here) can do
        MD5.

    MD5 is just the hashing algorithm, with is used in www-digest
    authentication.

    The issue here is not that someone hates M$, but it is that SIP
    phones implement only www-digest authentication mechanism, which
    requires to store the password in clear text or HA1 format (which is
    md5 over username, realm and password).

    If you try to integrate with an existing system that stored the
    passwords in some shadow form, it is not just working. For each
    account you need to store the password in what www-digest can use
    for authentication.

       I "would love" to see a "#!define WITH_RADIUS" at
        kakailio.cfg but we don't have it. However, as long as I
        understood, the RADIUS module is moving to obsolete as the AUTH
        module now also includes the RADIUS functionalities.

        So, can you share any link where I can find some for dummies
        examples of using the current AUTH module to do RADIUS
        authentication?

    As Juha pointed in another reply, you misunderstood, radius
    authentication has to be done using auth_radius module (there were
    two, only one was removed).

    This tutorial is quite old, but still good for starting with:

    - http://www.kamailio.org/docs/openser-radius-1.0.x.html

    Cheers,

    Daniel

        Cheers!

        Moacir

          Date: Wed, 19 Dec 2012 23:18:58 +0100

          From: miconda at gmail.com

          To: sr-users at lists.sip-router.org

          CC: moacirferreira at hotmail.com

          Subject: Re: [SR-Users] RADIUS authentication

          Hello,

          it might not be possible if you don't have the digest
          authentication module in the radius server. Also, that means
          the passwords have to be stored in plain text or HA1 hash (md5
          hash based on digest auth algorithm). Do you have these
          available in the M$ radius server?

          Cheers,

          Daniel

          On 12/19/12 10:30 PM, Moacir
            Ferreira wrote:

             I am trying to integrate Kamailio as the SIP
              server for an enterprise company. The challenge is to
              authenticate the SIP users using the Microsoft RADIUS/AD
              so the users can use the same Windows user name and
              password on their PC softphone. As Microsoft has its own
              RADIUS server integrated with its Active Directory, has
              anyone has tried to use this kind of set up? Can you share
              docs, links, examples or whatsoever you think could help
              me? The only thing I am looking for is replacing the
              MySQL Kamailio authentication by RADIUS, nothing else.

              Thanks,

              Moacir

            _______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users at lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

          -- 
Daniel-Constantin Mierla - http://www.asipto.com
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda

    -- 
Daniel-Constantin Mierla - http://www.asipto.com
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sip-router.org/pipermail/sr-users/attachments/20121220/f029e0f2/attachment-0001.htm>