[OpenSIPS-Users] LDAP Authentication

[Alan Rubin]

Bogdan,

Yes, my script is derived from the default and I have enabled MySQL and
added PUA, PUA_userloc and Presence modules.

Regards,

Alan Rubin
Unix Systems Administrator
DCS Midrange Services
Phone: +61 (08) 8999 5111
Fax:      +61 (08) 8999 7493
e-Mail: alan.rubin at nt.gov.au
 
-----Original Message-----
From: Bogdan-Andrei Iancu [mailto:bogdan at voice-system.ro] 
Sent: Tuesday, 16 June 2009 9:59 AM
To: Alan Rubin
Cc: Thiago Rondon; users at lists.opensips.org
Subject: Re: [OpenSIPS-Users] LDAP Authentication

Hi Alan,

put in in the main route, where you need to do the authentication...Is 
your script derived from the default opensips cfg file ?

Regards,
Bogdan

Alan Rubin wrote:
> Bogdan,
>
> Thanks for the help.  Is the script part inside of the main route or
is
> it a separate section?
>
> Regards,
>
> Alan Rubin
> Unix Systems Administrator
> DCS Midrange Services
> Phone: +61 (08) 8999 5111
> Fax:      +61 (08) 8999 7493
> e-Mail: alan.rubin at nt.gov.au
>  
> -----Original Message-----
> From: Bogdan-Andrei Iancu [mailto:bogdan at voice-system.ro] 
> Sent: Tuesday, 16 June 2009 8:58 AM
> To: Alan Rubin
> Cc: Thiago Rondon; users at lists.opensips.org
> Subject: Re: [OpenSIPS-Users] LDAP Authentication
>
> Hi Alan,
>
> The way to do it is like:
>
> 1) configure the auth module to do authentication via
Pseudo-variables:
>
> # -- auth params --
> modparam("auth", "nonce_expire",  30)
> modparam("auth", "secret", "my-deepest-and-darkest-secret")
> modparam("auth", "disable_nonce_check", 0)
> modparam("auth", "username_spec", "$avp(i:2)")
> modparam("auth", "password_spec", "$avp(i:1)")
> modparam("auth", "calculate_ha1", 1)
>
> 2)  and in script do:
>
>     # are any credentials available in the request ?
>     if (!is_present_hf("Proxy-Authorization")) {
>         proxy_challenge("", "0");
>         exit;
>     }
>
>     # run the ldap_query() and load the passwd into $avp(i:1)
>     # TODO
>
>     # username to authenticate
>     $avp(i:2) = $fU;
>
>     # do the authentication
>     if(!pv_proxy_authorize("")){
>         proxy_challenge("", "0");
>         exit;
>     }
>
>
> Regards,
> Bogdan
>
>
> Alan Rubin wrote:
>   
>> Bogdan,
>>
>> I want to use LDAP to authenticate clients.  We're using it for our
>>     
> XMPP
>   
>> server (amongst other services) without issues.
>>
>> Regards,
>>
>> Alan Rubin
>> Unix Systems Administrator
>> DCS Midrange Services
>> Phone: +61 (08) 8999 5111
>> Fax:      +61 (08) 8999 7493
>> e-Mail: alan.rubin at nt.gov.au
>>  
>> -----Original Message-----
>> From: Bogdan-Andrei Iancu [mailto:bogdan at voice-system.ro] 
>> Sent: Tuesday, 16 June 2009 8:24 AM
>> To: Alan Rubin
>> Cc: Thiago Rondon; users at lists.opensips.org
>> Subject: Re: [OpenSIPS-Users] LDAP Authentication
>>
>> Hi Alan,
>>
>> Do you want to use LDAP to authenticate clients or to authenticate 
>> opensips against other SIP server?
>>
>> Regards,
>> Bogdan
>>
>>
>> Alan Rubin wrote:
>>   
>>     
>>> Thiago, 
>>>
>>> Thanks for the reply; however, the module documentation does not
seem
>>>     
>>>       
>> to
>>   
>>     
>>> give examples on how to configure LDAP with the auth mechanism.  Or
>>>       
> is
>   
>>> that not necessary?
>>>
>>> This is the section from the tutorial I found, mentioned previously:
>>>
>>> modparam("auth", "username_spec", "$avp(s:username)")
>>> modparam("auth", "password_spec", "$avp(s:password)")
>>> modparam("auth", "calculate_ha1", 1)
>>> ...
>>>
>>> The possible difference (typo?) that concerns me is this next
>>>     
>>>       
>> reference
>>   
>>     
>>> in the tutorial:
>>>
>>> route[11] {
>>>     if(is_method("REGISTER"))
>>>     {
>>>         if(is_present_hf("Authorization"))
>>>         {
>>>             # ldap search
>>>             if
>>>
>>>     
>>>       
>
(!ldap_search("ldap://sipaccounts/ou=sip,dc=example,dc=com?SIPUserName,S
>   
>>   
>>     
>>> IPPassword?one?(cn=$fU)"))
>>>             {
>>>                 switch ($retcode)
>>>                 {
>>> ...
>>>
>>> I have no "route[11]" in my configuration file.  Am I meant to
create
>>>     
>>>       
>> a
>>   
>>     
>>> new route section to handle LDAP authentication?  
>>>
>>> What I am trying to do, if it is not clear, is use LDAP as a
>>>       
> mechanism
>   
>>> for authentication/registration of SIP accounts rather than having
to
>>> configure, by hand and with a separate password, a SIP account for
>>>     
>>>       
>> each
>>   
>>     
>>> user of my SIP server.
>>>
>>> Regards,
>>>
>>> Alan 
>>>  
>>> -----Original Message-----
>>> From: users-bounces at lists.opensips.org
>>> [mailto:users-bounces at lists.opensips.org] On Behalf Of Thiago Rondon
>>> Sent: Monday, 15 June 2009 1:47 PM
>>> To: Alan Rubin
>>> Cc: users at lists.opensips.org
>>> Subject: Re: [OpenSIPS-Users] LDAP Authentication
>>>
>>>
>>>
>>> Alan,
>>>
>>> How about the document of ldap module ?
>>>
>>> http://www.opensips.org/html/docs/modules/1.5.x/ldap.html
>>>
>>> -Thiago Rondon
>>>
>>> Alan Rubin escreveu:
>>>   
>>>     
>>>       
>
>
>