Adding Attributes to an Access-Accept

This feature allows you to add attribute values retrieved from an external subscriber database to Access-Accept message. For example, you might want to include the subscriber’s level of service in the Access-Accept as the value of the attribute Reply-Message. Another example might be retrieving the IP address to be assigned to a mobile node and returning it in the Access-Accept as the value of the attribute Framed-IP-Address.

Overview

You can add additional attributes to Access-Accept messages from an external subscriber database. Two authentication plug-ins are used to accomplish the tasks of authentication and adding attributes to an Access-Accept. The authentication plug-ins are:

• The SIMAuth application (acting as the EAP helper)
  This authenticator provides EAP authentication for the SIM authentication module.
• Helped authenticator (usually the SQL plug-in: radsql.aut or radsqljdbc.aut). This authenticator accesses the database, retrieves the specified attributes, and attaches them to the Access-Accept message. The helped authenticator does not perform any authentication tasks and its password-checking is suppressed. All authentication is performed by the SIMAuth application (the EAP helper).

Data Flow

Authentication of the Access-Request and the addition of attributes to the Access-Accept is handled according to the following flow of data:

1. The mobile device sends an Access-Request to Steel-Belted Radius Carrier.
2. SIMAuth manages the EAP negotiation (challenge, and response).
3. If SIMAuth authenticates the request, it attaches the IMSI and MSISDN of the mobile device, and sends the request to the SQL plug-in: radsql.aut or radsqljdbc.aut.
4. radsql.aut or radsqljdbc.aut can use the IMSI or MSISDN as a key to query the database and request attribute values (as a separate step from the SIMAuth authentication).
5. The helped authenticator (usually the SQL authentication plug-in: radsql.aut or radsqljdbc.aut), returns the Access-Accept with attribute values attached.

   Note: SIMAuth is known as a Steel-Belted Radius Carrier EAP helper because it performs the EAP authentication for the helped authentication method (usually the SQL authentication plug-ins: radsql.aut or radsqljdbc.aut). Although these SQL plug-ins are usually used for authentication, in this case their function is to access the subscriber database, retrieve attributes, and return them with the Access-Accept. For complete information about EAP helpers, see the SBR Carrier Administration and Configuration Guide.

Figure 21 shows an example data flow in which Steel-Belted Radius Carrier, SIMAuth, and the SQL plug-ins (either radsql.aut or radsqljdbc.aut) work together to perform the following tasks:

• Access authentication (performed by SIMAuth)
• Addition of MSISDN and IMSI to the request (performed by SIMAuth)
• Database access and attribute retrieval (performed by radsql.aut in this example called SQLAuthenticator)
• Addition of retrieved attributes to the Access-Accept (performed by the SQL plug-in: radsql.aut)

  Figure 21: Example Data Flow for Addition of Attribute to Access-Accept

  

Configuration Tasks

To add attributes to the Access-Accept, perform the following tasks:

• Configure the related files, as described in Configuring Files for Adding Attributes to Access-Accept.
• Activate authentication as described in Activate the Authentication Method.

Configuring Files for Adding Attributes to Access-Accept

The following files require special configuration to allow the addition of attributes to the Access-Accept:

• simauth.aut
• simauth.eap
• radsql.aut, radsqljdbc.aut, or ldapauth.aut
• eap.ini

To configure files for adding attributes to Access-Accept:

1. In the [Bootstrap] section of simauth.aut (for Oracle databases), set Enable=0.

   Setting Enable=0 ensures that these files are disabled.

   Example:
   [Bootstrap]
   Enable=0

2. Create a copy of simauth.aut and name it simauth.eap.

   This renaming causes SIMAuth to become the EAP helper.

3. In the [Bootstrap] section of simauth.eap, ensure that Enable=1.
4. Open the relevant database access configuration file. This file is one of:
   • radsql.aut
   • radsqljdbc.aut
   • ldapauth.aut
5. Check the [Bootstrap] section of radsql.aut, radsqljdbc.aut, or ldapauth.aut for the name of the specified authentication method. In the following example, the name of the specified authentication method is “SQLAuthenticator”.

   Example:
   [Bootstrap]
   Initializationstring=SQLAuthenticator

   For more information about how to configure the radsql.aut and radsqljdbc.aut files, see SQL Authentication in this guide. For more information about configuring SQL authentication, see the SBR Carrier Administration and Configuration Guide.

   For more information about how to configure the ldapauth.aut file, see LDAP Authentication in this guide. For more information about configuring LDAP authentication, see the SBR Carrier Administration and Configuration Guide.

6. Ensure that there is a section in the eap.ini file that includes the name of the helped authentication method you specified in Step 5. In this example the name is “SQLAuthenticator”.

   Example:
   [SQLAuthenticator]

7. Ensure that the following lines are included in the helped authentication method section in eap.ini that you created in Step 6.

   [SQLAuthenticator]
   EAP-Only=1
   First-Handle-Via-Auto-EAP=1
   EAP-Type=SIM,AKA
   Available-EAP-Only-Values=1
   Available-Auto-EAP-Values=1
   Available-EAP-Types=SIM|AKA

   Note: The lines added in Step 7 configure the specified authentication method (in this case the SQL plug-in: radsql.autwe named: SQLAuthenticator), and also prevent it from being used without the EAP helper (SIMAuth.aut). The use of the helped authentication method (radsql.aut or radsqljdbc.aut) without the EAP helper must be prevented because password checking is suppressed and the EAP helper (SIMAuth.aut) is needed to perform authentication.

8. Suppress database password checking in the helped authentication method as described for Oracle, JDBC, and LDAP databases.
   • Oracle or JDBC: Do not provide a password in the SQL=SELECT statement in the [Settings] section of radsql.aut or radsqljdbc.aut. In the [Results] section of these files, include a PASSWORD= statement, leaving the password blank.
     
     Example:
     [Results]
     Password=
   • LDAP: Remove the %password= setting from the [Response] section.
9. Insert a query into radsql.aut, radsqljdbc.aut, or ldapauth.aut to select the attributes to be added to the Access-Accept.

   The selection of attributes from the database can be based on the database key values for IMSI or MSISDN. The values for IMSI or MSISDN are added to the request by SIMAuth in the attributes 3GPP-IMSI or Funk-SS7-MSISDN so that they can be used in the database query.

   Example:

   SQL=SELECT subscriber-level FROM table 1 WHERE IMSI=@3GPP-IMSI

   Note: To have the 3GPP-IMSI attribute set by Steel-Belted Radius Carrier in the request, the 3GPP dictionary must be selected in the Make or model field in the RADIUS Clients List page of Web GUI, or you must import the attribute using the @ character which indicates the dictionary file contents are to be included (see Include Records). You can also use the %username or %user variables in the database query. However, they do not contain the expected values if pseudonyms are active.

10. Activate the helped authentication method. For more information about setting up authentication policies and defining the order of authentication methods, see the SBR Carrier Administration and Configuration Guide.

Example Configuration for Adding Attributes to Access-Accept

Figure 22 shows a sample configuration. The purpose of this configuration is to query the database for a subscriber-level value and return the subscriber-level value along with the Access-Accept.

Example Overview

In this example, an Access-Request is sent for a mobile device with IMSI 123456789. The value of the subscriber-level for this device is retrieved from the database, assigned to the attribute Reply-Message, and attached to the Access-Accept.

The configuration lines and syntax (shown in Figure 22) associate all the configuration files together to attach an attribute to the Access-Accept.

Figure 22: Example Configuration for Adding Attributes to an Access-Accept

Example Notes

The sample configuration shown in Figure 22 configures the data flow in the following way:

Access-Request

An Access-Request is sent to Steel-Belted Radius Carrier for the user with an IMSI value of 123456789.

SIMAuth

simauth.eap file is enabled
simauth.aut file is disabled.

Radsql.aut

The [Bootstrap] section contains the name of the specified authentication method (“SQLAuthenticator”). You later add a [SQLAuthenticator] section to the eap.ini file.

Enter a SQL=SELECT statement to retrieve data from the database based on the value of the IMSI in the Access-Request. Do not include a password in the SQL SELECT statement.

The @Password= statement suppresses password checking of the database.

The @Reply-Message=1/40 field indicates the following:

• The Reply-Message attribute is added to the Access-Accept and carry the value retrieved from the database.
• The 1 in @Reply-Message=1/40 indicates that the first item in the SQL=SELECT statement (subscriber-level) is the column name of the SQL database from which the value is selected.
• The 40 in @Reply-Message=1/40 indicates that the width of the subscriber-level column is 40 characters.

Eap.ini

The eap.ini file must contain a section corresponding to the name of the helped authentication method named in the Initializationstring statement in the radsql.aut file. In this example the helped authentication method is called “SQLAuthenticator”, so the eap.ini must contain a section called [SQLAuthenticator].

The eap.ini file must contain the lines shown in Figure 22 to configure the SQL plug-in (either radsql.aut or radsqljdbc.aut). These lines, prevent either radsql.aut or radsqljdbc.aut from acting without SIMAuth.aut. This is necessary because password-checking by radsql.aut or radsqljdbc.aut is suppressed and the only authentication being performed would be by the EAP helper (SIMAuth.aut).

SQL Database Table 1

In this example, the SQL database is queried by the SQL plug-in: radsql.aut, and the subscriber-level for IMSI 123456789 is found to be basic.

Access-Accept

The value of basic is assigned to the attribute Reply-Message and included in the Access-Accept.

Activate the Authentication Method

For information about activating and setting up authentication policies, and defining the order of authentication methods, see the SBR Carrier Administration and Configuration Guide.