Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation  Back up to About Overview 
  
[+] Expand All
[-] Collapse All

SQL Authentication

This section describes the configuration file that controls SQL authentication in Steel-Belted Radius Carrier. The configuration file resides in the radiusdir directory.

The format of a configuration file is comparable to that of a Windows INI file: composed of several sections; section names are enclosed in brackets; each section may contain multiple parameter/value pairs.

Table 152: SQL Authentication Configuration File

File

Function

radsql.aut

Configures Oracle SQL authentication for Steel-Belted Radius Carrier.

radsqljdbc.aut

Configures JDBC SQL authentication for Steel-Belted Radius Carrier.

[Settings] Section

The [Settings] section of the SQL authentication configuration file defines parameters that control the database connection.

PasswordFormat

  • If set to 0, Steel-Belted Radius Carrier tries to determine password format automatically.
  • If set to 3, Steel-Belted Radius Carrier expects the password value encrypted with UNIXcrypt.

By default, the PasswordFormat parameter is in radsql.aut and radsqljdbc.aut.

ClearTextBinary

Specifies whether cleartext binary passwords are allowed. Setting this parameter to a non-zero value allows you to use cleartext binary passwords.

This parameter must be set to the length of the binary passwords in operation.

Note: In parameters that specify the SQL statement to be executed, cleartext binary passwords must be passed using binary compatible data types, for example, VARBINARY in the case of Oracle.

DefaultResults

  • If set to 0, no default values are assumed and the user must explicitly enter all result items (if you are not calling a stored procedure).
  • If set to 1, the default values for Results are used. This is the backward-compatibility setting and the setting if no value is specified in the file. In this case, each Result item must be explicitly specified.

SuccessResult

Specifies the string that is the expected result of a successful authentication, to be compared to the %result parameter.

If a value is specified for this field, it is used in the following manner upon execution of the SQL statement: if the value of %result is not equal to the value given for this field, the user is rejected. The test for textual equality is not case sensitive.

No such test, or rejection, is performed if no value is specified for this field.

This is a useful technique for coordinating with the custom functionality of stored procedures.

UpperCaseName

Specifies whether the user's login name is converted to uppercase characters before using it in the SQL statement execution.

  • 0—Use the name exactly as received.
  • 1—Convert the name to uppercase.

[Results] Section

The [Results] section (Table 153) of the SQL authentication configuration file maps the columns named in its SELECT query to the type of data that Steel-Belted Radius Carrier expects these columns to contain.

[Results]
Password=1/48
Profile=2/48

The following parameters (Table 153) may be present in a [Results] section. Each parameter represents a type of data required to authenticate an Access-Request, and if desired, apply authorization information as well.

Note: The Profile option and the Alias option cannot be used together. Read the following descriptions and choose the one that suits your needs.

Table 153: *.aut [Results] Syntax

Parameter

Function

%LoginLimit

Specifies the name of the variable identifying the Maximum Concurrent Connection limits.

%Password

The value returned from this column is understood to be the user's password. The value returned by the SQL query is then matched with the user's password received in the Access-Request.

By default, Steel-Belted Radius Carrier expects the user's password to be stored in the SQL table in clear-text format. If you want to configure Steel-Belted Radius Carrier to expect that the password value is encrypted with UNIXcrypt, then set PasswordFormat to 3 in the [Settings] section of the SQL authentication configuration file.

%Profile

The value returned from this column is interpreted as the name of the profile to associate with the user. The value returned by the SQL query is matched with an existing Profile entry of the same name. If the value is prof1, and a Profile called prof1 exists in the Steel-Belted Radius Carrier database, any return list or check list attributes in prof1 are applied to the user's connection.

If the value cannot be matched with an existing Profile in the Steel-Belted Radius Carrier database, the user is rejected due to “Insufficient Resources.”

%ProxyRealm

Specifies the realm to which the authentication must be proxied. If ProxyRealm is not set, Routed Proxy does not occur.

%ProxyUserName

Specifies the User-Name attribute, which must be sent in the proxy request. If ProxyUserName is not set, the User-Name from the original request packet is used.

Note: Enter the value for %ProxyUserName in capital letters.

%Alias

Specifies the value returned from this column that is matched with an existing Steel-Belted Radius Carrier Native User entry of the same name.

For example, if the value is max1, and a native user called max1 exists in the Steel-Belted Radius Carrier database, then any return list or check list attributes, as well as any concurrent connection limit configured for max1, are applied to the user's connection.

If you want to apply concurrent connection limits to users who are being authenticated by means of SQL, you must set up a Native User entry with no password.

Note: Use of %Alias is not recommended. Instead, use %Profile.

The %LoginLimit value lets you implement the concurrent connection limits previously available through %Alias.

Generally, even if a very large number of users resides in the SQL database, you need to add only one or two Native User entries to the Steel-Belted Radius Carrier database. The concurrent connection limit associated with a single Native User entry may be applied to any number of users in the SQL database. Often a Native User entry with a connection limit of 1, and a second Native User entry with a connection limit of 2, is sufficient for an entire SQL database.

For example, analog users may be allowed a connection limit of 1, while ISDN users are allowed a connection limit of 2.

Note: The Native User authentication method displayed in the Authentication Methods page does not need to be activated for the %Alias feature to work.

%FullName

The value returned from this column is interpreted as the full name of the user. This feature is often used to distinguish the user's full name from the actual User-Name sent in the Access-Request.

RADIUS attributes

Any RADIUS attribute (preceded by an @) can be returned from the database and mapped into the [Results] section. Use attribute names as they appear in the appropriate .dct or .jdict (subattributes) files.

Consider the following SELECT statement:

SELECT user_pwd, attribs, fullname FROM rasusers WHERE user_id = %name

where user_pwd, attribs, fullname, and user_id are the names of columns in the SQL table, and rasusers is the name of the SQL table itself. The [Results] section of this configuration file must map the SQL table columns user_pwd, attribs, and fullname to authentication or authorization data types, or both; for example.

[Results]
Password=1
Profile=2
FullName=3

Columns in the SQL query are identified in the [Results] section by number; 1 represents the first column in the SELECT query (from left to right), and if other columns are also referenced, 2 represents the second, and 3 the third.

Along with a number representing the column order, each entry in the [Results] section also specifies the storage format of the column in the SQL table, using the same slash (/), length, and type conventions as the SQL query.

Default [Results] Parameters

The DefaultResults flag in the [Settings] section of radsql.auth_ora.so specifies whether default values for Password, Profile, Alias, and FullName are automatically bound to the returned SQL data. The default radsql.auth_ora.so file sets it to 0.

With DefaultResults=0, the results list is no longer automatically bound, and only explicit columns in the [Results] section, or embedded Parameters to a stored procedure, are used. This is the recommended setting.

The DefaultResults=1 option remains only for backward-compatibility with old .aut files that rely on the default results behavior to ensure that the set of default columns are automatically bound.

[FailedSuccessResultAttributes] Section

The [FailedSuccessResultAttributes] section (Table 154) of the SQL authentication configuration file can be used to map any RADIUS attribute returned from the database. Attributes can be specified in two ways:

  • Attributes can be specified with a literal value enclosed in single quotes. Values must be enclosed with single quotes, even when they represent numeric values.
  • Attributes can be specified with a numeric value that corresponds to the ordering of values returned from the SQL select statement.

Precede attribute names with @ and enter them as they appear in the dictionary (.dct) files, or the subattribute dictionary (.jdict) files. Enclose attribute values (including integers and IP addresses) in single quotes. For example:

[FailedSuccessResultAttributes]
@Reply-Message = ‘Please re-enter your password.’
@Filter-Id = ‘3’

[Failure] Section

The [Failure] section of the SQL authentication configuration file can be used to determine the result of the authentication process (accept or reject) when connectivity to all of the configured SQL databases has failed. For example:

[Failure]
Accept = 1
Profile = XYZ
FullName = Unauthenticated!

Note: The Profile option and the Alias option cannot be used together. Read the following descriptions and choose the one that suits your needs.

Table 154: *.aut [Failure] Syntax

Parameter

Function

Accept

  • If set to 1, Steel-Belted Radius Carrier returns an Access-Accept packet with the Profile and any combination of the FullName and Alias attributes specified in the corresponding [Failure] section parameters.
  • If set to 0, the user is rejected.

Profile

Specifies the name of a Steel-Belted Radius Carrier profile whose check list and return list attributes are applied to the user's connection.

FullName

By indicating a FullName, Steel-Belted Radius Carrier returns a value in the class attribute, allowing for all [Failure] connections to be accounted.

[Strip] Sections

The [Strip] sections (Table 155) of the SQL authentication configuration file (Table 155) allow User-Name stripping to occur. These sections enable Steel-Belted Radius Carrier to identify the username that the SQL database expects by stripping the incoming User-Name attribute value of realm names and other “decorations.”

You may or may not need to employ User-Name stripping for SQL authentication. Your need for this feature depends upon the naming conventions that you employ on your network and in your SQL database entries. The SBR Carrier usual name parsing features work independently of this feature.

The following [Strip] syntax is available to enable and configure User-Name stripping for SQL authentication:

[Strip]
Authentication=Yes

[StripPrefix]
String
String
.
.
.
[StripSuffix]
String
String
.
.
.

Table 155: *.aut [Strip] Syntax

Parameter

Function

Authentication

  • If set to No, prefix and suffix stripping is disabled for authentication.
  • If set to Yes, prefix and suffix stripping is enabled for authentication packets. When an authentication packet comes into the Steel-Belted Radius Carrier server and a SQL authentication method is active, stripping of the incoming UserName attribute value occurs before SQL authentication:
    1. Prefixes listed in the [StripPrefix] section are stripped from the incoming UserName attribute value.
    2. Suffixes listed in [StripSuffix] are stripped.
    3. Any other name processing that is appropriate at this point (for example, tunnel or proxy name parsing) is performed.
    4. The fully stripped name is authenticated against the SQL database.

[StripPrefix]

Lists strings that are to be stripped from the beginning of the UserName value. The strings are listed in order of priority. A string that appears earlier in the list takes precedence over later strings.

In the following example, if the incoming UserName is seattleUser201, the stripped name is User201. If the incoming UserName is seatac2000, the stripped name is tac2000:

[StripPrefix]

seattle

sea

String

Each String that you provide in a [Strip] section may be a character string, or a regular expression according to the following rules:

? is a wildcard character.

A dash (-) indicates a range of alphanumeric characters; brackets must enclose lists of characters or ranges. For example, [A-Za-z] means any letter and [0-9.,] means any number, including decimal points and commas.

A backslash (\) followed by a non-alphanumeric character indicates that character literally, for example \’ indicates the question mark.

\ is also used as an escape character:

\a bell (7)

\b backspace (8)

\t tab (9)

\n newline (10)

\v vertical tab (11)

\f formfeed (12)

\r return (13)

\xnn hex value, where nn are 2 hex digits

\nnn decimal value, where nnn are 3 decimal digits

[StripSuffix]

Lists strings that are to be stripped from the end of the User-Name value. Conventions are the same as for [StripPrefix].

Example: SQL Authentication Configuration File

This section provides an example of an Oracle radsql.aut configuration file.

[Bootstrap]
Enable=0
LibraryName=radsql_auth_ora.so
InitializationString=SQL-ORACLE

[Settings]
Connect=dBusername/dBpassword
SQL=SELECT password, profile FROM userlist WHERE name = %name/40
ParameterMarker=?
MaxConcurrent=1
ConcurrentTimeout=30
WaitReconnect=2
MaxWaitReconnect=360
PasswordFormat = 0
DefaultResults = 0
;ShutdownTimeout=360
ErrorMap=oracle.ini
LogLevel=0

[Server]
s1=2
s2=2

[Server/s1]
Connect=db_admin1/db_password1

[Server/s2]
Connect=db_admin2/db_password2

[Results]
Password=1/48
Profile=2/48
Alias=2/48

[Failure]
Accept=0
Profile=xyz
FullName=Remote User

Modified: 2017-03-07