Directed Realm Configuration (.dir) File

A directed realm specifies target methods for directed authentication and directed accounting. Its realm configuration file is called RealmName.dir. By default, a sample .dir file (example.dir) is installed with Steel-Belted Radius Carrier.

The directed authentication feature permits the server to bypass its Authentication Methods list and map an incoming RADIUS request to one or more specific authentication methods. Steel-Belted Radius Carrier chooses the destination method based on routing information found in the request packet. The destination methods may be any authentication methods already configured on the local Steel-Belted Radius Carrier server, regardless of how they were configured; for example, a method may have been configured using Web GUI, the LDAP configuration interface, or an .aut configuration file.

If no directed authentication method is configured, every request percolates through the same Authentication Methods list, as defined in the authentication methods listed in the Authentication Methods page in Web GUI. This behavior may or may not be ideal for every customer. Directed authentication lets you tailor an Authentication Methods list to a customer’s needs.

Directed accounting is also possible. The destination accounting method may be the Steel-Belted Radius Carrier accounting log, an external database configured using an .acc file, or a distinct accounting log file that contains entries only for this customer.

To activate these features, you must create RealmName.dir files, place them in the Steel-Belted Radius Carrier directory, and list them in the [Directed] section of proxy.ini. Subsequently, any requests that arrive addressed to one of these realm names are processed on the local server using the instructions you provided in proxy.ini and the corresponding RealmName.dir file.

After you edit a RealmName.dir file, you must apply your changes. If you have added or changed:

• Any directed accounting methods, you must stop and restart the server to load your new configuration.
• Directed authentication methods in which external database (SQL or LDAP) authentication is used, you must stop and restart the server to load your new configuration.
• Directed authentication methods in which local or pass-through (Native, UNIX, or Host) authentication is used, you can apply your configuration changes dynamically, without stopping the server.

  Issue the SIGHUP (1) signal to the Steel-Belted Radius Carrier process.
       #./sbrd hup

  Steel-Belted Radius Carrier re-reads proxy.ini, filter.ini, and all .pro and .dir files in the server directory, and resets its realm configuration accordingly.

  Note: If you edit radius.ini while configuring a realm, you must restart Steel-Belted Radius Carrier to load your new configuration.

[Auth] Section

Directed authentication is enabled in a realm by setting the Enable parameter in the [Auth] section (Table 106) of the corresponding RealmName.dir file, where RealmName is the name of the realm. The syntax is:

[Auth]
Enable = 1
StripRealm = 1
UseMasterDictionary = yes
FilterOut = name
FilterIn = name
ServerCertificate = 

[AuthMethods] Section

If directed authentication is enabled, the [AuthMethods] section of a RealmName.dir file lists one or more authentication methods to be used.

The syntax is:

where Description is the official name of an authentication method configured on the Steel-Belted Radius Carrier server. For example:

[AuthMethods]
Native User
UNIX User
UNIX Group
<InitializationString=SQL>
<InitializationString=LDAP>

If you want your [AuthMethods] section to reference an external authentication method, a Description string must match the names of that method. If you want your [AuthMethods] section to reference an external database, enter the InitializationString value from the [Bootstrap] section of the corresponding .aut file.

Note: There is no interaction between the settings in the Authentication Methods page and in RealmName.dir files, or between different RealmName.dir files. For example, if you disable the UNIX User method in the Authentication Methods page while it is enabled in a RealmName.dir file, it remains enabled in RealmName.dir.

[Acct] Section

Directed accounting is enabled in a realm by setting the Enable parameter in the [Acct] section (Table 107) of the corresponding RealmName.dir file, where RealmName is the name of the realm. The syntax is:

[Acct]
Enable = 1
StripRealm = 0
RecordLocally = 0
UseMasterDictionary = yes

[AcctMethods] Section

If directed accounting is enabled, the [AcctMethods] section of a RealmName.dir file lists one or more accounting methods to be used. The syntax is:

where Description is the official name of a directed accounting method configured in the proxy.ini file.

[Called-Station-ID] Section

The [Called-Station-ID] section of a RealmName.dir file allows Steel-Belted Radius Carrier to select a realm to be used for directed authentication and accounting based on DNIS information supplied in an incoming RADIUS packet. The [CalledStationID] section lists each DNIS string that identifies the realm. If this string is found in the CalledStationId attribute of an incoming request, the directed authentication and accounting rules found in the corresponding RealmName.dir file are applied to the request.

The syntax is:

where String is a DNIS string.

[ModifyUser] Section

The [ModifyUser] section (Table 108) of a realm directed file permits you to decorate a realm, where the realm is determined by other means, such as DNIS or attribute mapping.

This is used mainly to enhance directed realms. For example, the following two users are in the database: george@gm and george@ford. Either user can log in as george, because Steel-Belted Radius Carrier determines the realm, for example, by DNIS. Based on the realm, Steel-Belted Radius Carrier appends either @gm or @ford to the username, and then uses the Native User directed method to authenticate.