The CommuniGate Pro Server can use an external Helper program to implement a RADIUS authentication policy.
That program should be created by your own technical staff.
The program name and its optional parameters should be specified using the WebAdmin Helpers page.
Open the General page in the Settings realm, and click the Helpers link:
See the Helper Programs section to learn the meaning
of these options. The External RADIUS module System Log records are marked with the EXTRADIUS tag.
The External RADIUS Interface protocol is based on the generic Helper Protocol.
This manual describes the External RADIUS Interface Version 1.
If the External RADIUS program is not enabled, then the positive authentication response is sent as
soon as the user password is verified. The response does not contain any additional attributes.
If the External RADIUS program is enabled, it is used after the user password is verified. The Server
sends the following command:
nnnnnn LOGIN name@domain attributes settings
where:
-
- nnnnnn
- a unique sequence number for this request
- name
- user Account name
- domain
- user Account Domain name
- attributes
- a dictionary with all request attributes.
- settings
- a dictionary with the Account settings.
If the login request is accepted, the Helper program should return a positive response:
nnnnnn ACCEPT attributes
where:
-
- nnnnnn
- the request sequence number
- attributes
- a dictionary with the attributes to be added to the RADIUS response.
If the password was not accepted, a negative response should be returned:
nnnnnn REJECT optional-error-message
If the External RADIUS program is enabled, it is used to process the Start, Stop, and Interim-Update
accounting requests. The Server sends the following command:
nnnnnn ACCNT command name@domain attributes
where:
-
- nnnnnn
- a unique sequence number for this request
- command
- the accounting command (started, ended, updated)
- name
- user Account name
- domain
- user Account Domain name
- attributes
- a dictionary with all request attributes.
The Helper program should return a positive response:
nnnnnn OK
where:
-
- nnnnnn
- the request sequence number
The attributes in dictionaries should use the attribute type numeric values as keys
(for example 27 for Session-Timeout).
The following attributes are interpreted as 32-bit integer values and they are encoded
as numeric strings in dictionaries:
NAS-Port, Service-Type, Framed-Protocol, Framed-Routing, Framed-MTU,
Framed-Compression, Login-Service, Login-TCP-Port, Framed-IPX-Network, Session-Timeout,
Idle-Timeout, Termination-Action, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Event-Timestamp,
NAS-Port-Type, Port-Limit, ARAP-Zone-Access, Password-Retry, Prompt,
Tunnel-Type, Tunnel-Medium-Type, Tunnel-Preference, Acct-Interim-Interval,
Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Authentic,
Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause,
Acct-Link-Count, Acct-Input-Gigawords, Acct-Output-Gigawords.
The following attributes are interpreted as 32-bit IP addresses and they are encoded
as aaa.bbb.ccc.ddd strings in dictionaries:
NAS-IP-Address, Framed-IP-Address, Framed-IP-Netmask, Login-IP-Host.
The following attributes are not passed to the Helper and are ignored in Helper responses:
User-Name, User-Password, CHAP-Password, State, Proxy-State, EAP-Message,
Message-Authenticator, Acct-Status-Type.
All other attribute values are encoded either as a String or
as DataBlocks. The Server uses the DataBlocks format for those
attribute values that contain bytes outside the hexadecimal 0x20-0x7F range. The DataBlock format must be used
is the value contains binary zero bytes.
If an attribute has multiple values, the attribute value is encoded as an Array.
Accounting requests also have a numeric attribute 0 - the RADIUS protocol request ID. It can be used
to detect retransmitted packets (duplicate requests).
Sample session (I: - server commands sent to the program standard input, O: - responses
the program writes to its standard output):
-
I: 00001 INTF 1
O: 00001 OK 1
I: 00002 LOGIN user1@domain1.com {4=10.0.0.1;32="NAS 1";31=4153837164;} {RealName="User"; NATIP="192.168.1.3";}
O: 00002 ACCEPT {8=192.168.1.3; 9=255.255.255.0; 13=(0,3);}
I: 00002 LOGIN user1@domain1.com {32="NAS 2";31=415.5512.12; 8=192.168.1.3;} {NATIP="10.0.1.114";}
O: 00003 REJECT
I: 00004 ACCNT started user1@domain1.com {0=120;32="NAS 2";31=415.5512.12; 8=192.168.1.3;}
O: 00004 OK
Note: the Server can send several concurrent requests for the same target Account.
Note: the External RADIUS program is called when the target Account is open. In a
Dynamic Cluster system this means that External RADIUS programs should
run on backend servers, and that it is impossible that External RADIUS
programs running on two different backend servers get requests for the same Account at the same time.
Sample External RADIUS programs and scripts can be found at the
http://www.stalker.com/CGRADIUS/ site.
