[SR-Users] routing based on TLS auth

[Max]

Hi.

I've got bunch of sip gateways to use and bunch of asterisk instances connecting to
my Kamailio over TLS (own CA used).

I'd like to match source with destination based on TLS authentication:

* all the calls from asterisk A (TLS cert A) allowed via provider A
* all the calls from asterisk B (TLS cert B) allowed via provider B
...
* all the incoming calls from provider A forwarded to asterisk A (TLS cert A)
* all the incoming calls from provider B forwarded to asterisk B (TLS cert B)
...
* calls not coming from provider X or via TLS dropped.

Providers are regular VoIP gateways (login:password, connection via SIP).

I'm pretty sure this is possible with Kamailio but I'd appreciate any examples and
pointers to modules I should use to implement this. Or detailed explanation of why
this is a bad idea.

Also, I'm not sure where it's better to place user database - should it be separate
on per-asterisk basis? Central in Kamailio? No user db needed at all?

cheers,
Max.