Configuring the gsmmap.gen File
The gsmmap.gen file enables you to configure authentication settings by realm. This file consists of several sections that you need to configure, including:
This chapter describes each of these configuration sections.
[Bootstrap] Section
The [Bootstrap] section (Table 158) of the gsmmap.gen file enables the gsmmap.gen file to function.
Set to 1 to enable the features described in this file. |
|
Specifies the names of the module or modules (comma separated) that must be running for the MAP module to work. If you change the name of the data accessor files described in Configuring the Data Accessors for the SIM and SMS Authentication Modules, you must configure this parameter to match the new file name. |
Example
[Bootstrap]
LibraryName=gsmmap
Enable=1
DependsOn=ldapaccessor.gen,sqlaccessor.gen
[Settings] Section
The [Settings] section (Table 159) controls how log information is handled.
Example
[Settings]
ConfigLog=Log
[Realms] Section
The [Realms] section of the gsmmap.gen file contains a list of realms for which you specify authentication instructions. When an Access-Request is received, Steel-Belted Radius Carrier handles the request in different ways, depending on the settings in the [Realms] section. For example, requests from the ABC.com realm might require the IMSI retrieved from the LDAP database for authentication, requests from the XYZ.com realm might require the AKA from the MAP Gateway for authentication.
You can specify realms in several ways:
- By name - You can specify realms directly by listing names of authorized realms. Example:
abc.com. - By alias - You can create an alias for a realm by specifying the realm alias and realm name. Example:
realm1=abc.com - By wild-card alias - You can create an alias that includes a wildcard to permit authentication for multiple realms. Example:
realm2=*abc.comorrealm=abc.* - By unmatched realm - You can create an alias that applies to all realms that do not match any specified realm. Example:
CatchAllRealm=* - By no realm - You can capture all authentication requests that do not contain a realm with the
NoRealm=command.
Example
[Realms]
ABC.com
realm1=myrealm.com
realm2=*abc.com
CatchAllRealm=*
NoRealm=
Configuring Each Realm Section
For each realm or alias that you create in the [Realms] section, you must create a separate section identified by the specified realm name or alias in the gsmmap.gen file. Within each realm setting, you identify a target module for each type of information that might be required to authenticate a subscriber. The target module defines where to obtain the specified information for each type of authenticator.
For example, if ABC.com is one of the realms, you must create a target module for any of the EAP-SIM, EAP-AKA, SMS, IMSI, MSISDN, and Authorization authentication types that are used to authenticate subscribers from ABC.com.
Use the Default= setting to identify a target module to be called if any of the other settings are absent.
 |
NOTE: The Setting Name can be set to |
Example
In the following example, these configuration choices are specified:
- An Access-Request from ABC.com that requires an SMS text message is handled according to the settings in the UlticomSMSGateway target module section of
gsmmap.gen. - Access-Requests requiring an authorization string are handled according to the settings in the SQLDatabase target module section of
gsmmap.gen. - All other Access-Requests are handled according to the UlticomMapGateway target module section of
gsmmap.gen.
[ABC.com]
Default=UlticomMapGateway
SMS=UlticomSMSGateway
Authorization=SQLDatabase
Relationship Between Sections
Figure 24 illustrates the relationship between the [Realms] section, the specific named realm section, and the target module section in the gsmmap.gen file.
Network Equipment and Data Needed for Processing Access-Requests
Table 160 identifies the network equipment needed for authentication based on the action needed to process the Access-Request.
* If quintets are received but triplets are needed, the authentication module
converts the quintets to triplets according to specification 3G TS 33.102 available at
http://www.3gpp.org.
|
NOTE: You can set the Setting Name to None if you want to disable the setting. For example, |
Example: Authorization String
If an authorization string is required to process an Access-Request, the following might be true:
- Authorization string is in the database
- IMSI is received in the Access-Request
- Database is keyed off the MSISDN
In this case, the MSC is used to obtain the MSISDN based on the IMSI. Then the MSISDN is used to retrieve the Authorization string from the database or HLR.
Disabling Authorization from EAP-SIM
You can disable authorization completely from EAP-SIM (not fetch subscriber profile information from the HLR and not perform a SQL/LDAP query).
To disable authorization from EAP-SIM:
- Set
Authorization=Nonein the realm section of thegsmmap.genfile. - Remove all authorization options (BS, TS, and ODB) from the
authGateway.conffile for the target HLR, and disable the connection between the authGateway application and Steel-Belted Radius Carrier in theulcmmg.conffile. For complete details on theauthGateway.confandulcmmg.conffiles, see the Steel-Belted Radius Carrier 7.2 Installation Guide.
Target Module Section
For each target module that you list for a realm, you must create a configuration section that identifies settings to be used for that module. The settings that you must specify depend on the type of module being called. The target modules are described in Table 161.
The fields to be included in the target module section differ depending on the specific target module. For example, the MAP Gateway target module section in the gsmmap.gen file requires a different set of fields than the SMS Gateway target module. Table 162 through Table 165 list the fields required for each target module.
Target Module Fields (General Case)
MAP Gateway Target Module Fields
Example of MAP Gateway Target Module Fields
[UlticomMAPGateway]
ModuleType=GSM
LibraryName=library32/libulcmmg.so
RequiredModuleVersionNumber=1
SymbolPrefix=ulcm_mg_t_
InitializationString=conf/ulcmmg.conf
RequestTimeoutMs=10000
SQL Database Target Module Fields
Name by which the SQL data accessor registers itself with Steel-Belted Radius Carrier. This value must match the value entered in the MethodName setting in the |
|
Specifies whether the subscriber is identified by IMSI or MSISDN (key field). Valid values are: For more information about setting database keys, see Identifying Key Fields for Oracle, JDBC, and LDAP Databases. |
Example of SQL Database Target Module
[SQLDatabase]
ModuleType=Database
DatabaseAccessorMethodName=SQL Accessor
KeyForAuthorization=MSISDN
LDAP Database Target Module Fields
Name by which the SQL data accessor registers itself with Steel-Belted Radius Carrier. This value must match the value entered in the MethodName setting in the |
|
Specifies whether the subscriber is identified by IMSI or MSISDN. Valid values are: For more information about setting database keys, see Identifying Key Fields for Oracle, JDBC, and LDAP Databases. |
Example of LDAP Database Target Module
[LDAPDatabase]
ModuleType=Database
DatabaseAccessorMethodName=LDAP Accessor
KeyForAuthorization=IMSI
