Download This Guide
SQL Authentication
This section describes the configuration file that controls SQL authentication in Steel-Belted Radius Carrier. The configuration file resides in the radiusdir directory.
The format of a configuration file is comparable to that of a Windows INI file: composed of several sections; section names are enclosed in brackets; each section may contain multiple parameter/value pairs.
Table 152: SQL Authentication Configuration File
File | Function |
|---|---|
radsql.aut | Configures Oracle SQL authentication for Steel-Belted Radius Carrier. |
radsqljdbc.aut | Configures JDBC SQL authentication for Steel-Belted Radius Carrier. |
[Settings] Section
The [Settings] section of the SQL authentication configuration file defines parameters that control the database connection.
PasswordFormat
- If set to 0, Steel-Belted Radius Carrier tries to determine password format automatically.
- If set to 3, Steel-Belted Radius Carrier expects the password value encrypted with UNIXcrypt.
By default, the PasswordFormat parameter is in radsql.aut and radsqljdbc.aut.
ClearTextBinary
Specifies whether cleartext binary passwords are allowed. Setting this parameter to a non-zero value allows you to use cleartext binary passwords.
This parameter must be set to the length of the binary passwords in operation.
 | Note: In parameters that specify the SQL statement to be executed, cleartext binary passwords must be passed using binary compatible data types, for example, VARBINARY in the case of Oracle. |
DefaultResults
- If set to 0, no default values are assumed and the user must explicitly enter all result items (if you are not calling a stored procedure).
- If set to 1, the default values for Results are used. This is the backward-compatibility setting and the setting if no value is specified in the file. In this case, each Result item must be explicitly specified.
SuccessResult
Specifies the string that is the expected result of a successful authentication, to be compared to the %result parameter.
If a value is specified for this field, it is used in the following manner upon execution of the SQL statement: if the value of %result is not equal to the value given for this field, the user is rejected. The test for textual equality is not case sensitive.
No such test, or rejection, is performed if no value is specified for this field.
This is a useful technique for coordinating with the custom functionality of stored procedures.
UpperCaseName
Specifies whether the user's login name is converted to uppercase characters before using it in the SQL statement execution.
- 0—Use the name exactly as received.
- 1—Convert the name to uppercase.
[Results] Section
The [Results] section (Table 153) of the SQL authentication configuration file maps the columns named in its SELECT query to the type of data that Steel-Belted Radius Carrier expects these columns to contain.
[Results] Password=1/48 Profile=2/48
The following parameters (Table 153) may be present in a [Results] section. Each parameter represents a type of data required to authenticate an Access-Request, and if desired, apply authorization information as well.
| Note: The Profile option and the Alias option cannot be used together. Read the following descriptions and choose the one that suits your needs. |
Table 153: *.aut [Results] Syntax
Parameter | Function |
|---|---|
%LoginLimit | Specifies the name of the variable identifying the Maximum Concurrent Connection limits. |
%Password | The value returned from this column is understood to be the user's password. The value returned by the SQL query is then matched with the user's password received in the Access-Request. By default, Steel-Belted Radius Carrier expects the user's password to be stored in the SQL table in clear-text format. If you want to configure Steel-Belted Radius Carrier to expect that the password value is encrypted with UNIXcrypt, then set PasswordFormat to 3 in the [Settings] section of the SQL authentication configuration file. |
%Profile | The value returned from this column is interpreted as the name of the profile to associate with the user. The value returned by the SQL query is matched with an existing Profile entry of the same name. If the value is prof1, and a Profile called prof1 exists in the Steel-Belted Radius Carrier database, any return list or check list attributes in prof1 are applied to the user's connection. If the value cannot be matched with an existing Profile in the Steel-Belted Radius Carrier database, the user is rejected due to “Insufficient Resources.” |
%ProxyRealm | Specifies the realm to which the authentication must be proxied. If ProxyRealm is not set, Routed Proxy does not occur. |
%ProxyUserName | Specifies the User-Name attribute, which must be sent in the proxy request. If ProxyUserName is not set, the User-Name from the original request packet is used. Note: Enter the value for %ProxyUserName in capital letters. |
%Alias | Specifies the value returned from this column that is matched with an existing Steel-Belted Radius Carrier Native User entry of the same name. For example, if the value is max1, and a native user called max1 exists in the Steel-Belted Radius Carrier database, then any return list or check list attributes, as well as any concurrent connection limit configured for max1, are applied to the user's connection. If you want to apply concurrent connection limits to users who are being authenticated by means of SQL, you must set up a Native User entry with no password. Note: Use of %Alias is not recommended. Instead, use %Profile. The %LoginLimit value lets you implement the concurrent connection limits previously available through %Alias. Generally, even if a very large number of users resides in the SQL database, you need to add only one or two Native User entries to the Steel-Belted Radius Carrier database. The concurrent connection limit associated with a single Native User entry may be applied to any number of users in the SQL database. Often a Native User entry with a connection limit of 1, and a second Native User entry with a connection limit of 2, is sufficient for an entire SQL database. For example, analog users may be allowed a connection limit of 1, while ISDN users are allowed a connection limit of 2. Note: The Native User authentication method displayed in the Authentication Methods page does not need to be activated for the %Alias feature to work. |
%FullName | The value returned from this column is interpreted as the full name of the user. This feature is often used to distinguish the user's full name from the actual User-Name sent in the Access-Request. |
RADIUS attributes | Any RADIUS attribute (preceded by an @) can be returned from the database and mapped into the [Results] section. Use attribute names as they appear in the appropriate .dct or .jdict (subattributes) files. |
Consider the following SELECT statement:
where user_pwd, attribs, fullname, and user_id are the names of columns in the SQL table, and rasusers is the name of the SQL table itself. The [Results] section of this configuration file must map the SQL table columns user_pwd, attribs, and fullname to authentication or authorization data types, or both; for example.
[Results] Password=1 Profile=2 FullName=3
Columns in the SQL query are identified in the [Results] section by number; 1 represents the first column in the SELECT query (from left to right), and if other columns are also referenced, 2 represents the second, and 3 the third.
Along with a number representing the column order, each entry in the [Results] section also specifies the storage format of the column in the SQL table, using the same slash (/), length, and type conventions as the SQL query.
Default [Results] Parameters
The DefaultResults flag in the [Settings] section of radsql.auth_ora.so specifies whether default values for Password, Profile, Alias, and FullName are automatically bound to the returned SQL data. The default radsql.auth_ora.so file sets it to 0.
With DefaultResults=0, the results list is no longer automatically bound, and only explicit columns in the [Results] section, or embedded Parameters to a stored procedure, are used. This is the recommended setting.
The DefaultResults=1 option remains only for backward-compatibility with old .aut files that rely on the default results behavior to ensure that the set of default columns are automatically bound.
[FailedSuccessResultAttributes] Section
The [FailedSuccessResultAttributes] section (Table 154) of the SQL authentication configuration file can be used to map any RADIUS attribute returned from the database. Attributes can be specified in two ways:
- Attributes can be specified with a literal value enclosed in single quotes. Values must be enclosed with single quotes, even when they represent numeric values.
- Attributes can be specified with a numeric value that corresponds to the ordering of values returned from the SQL select statement.
Precede attribute names with @ and enter them as they appear in the dictionary (.dct) files, or the subattribute dictionary (.jdict) files. Enclose attribute values (including integers and IP addresses) in single quotes. For example:
[FailedSuccessResultAttributes] @Reply-Message = ‘Please re-enter your password.’ @Filter-Id = ‘3’
[Failure] Section
The [Failure] section of the SQL authentication configuration file can be used to determine the result of the authentication process (accept or reject) when connectivity to all of the configured SQL databases has failed. For example:
[Failure] Accept = 1 Profile = XYZ FullName = Unauthenticated!
| Note: The Profile option and the Alias option cannot be used together. Read the following descriptions and choose the one that suits your needs. |
Table 154: *.aut [Failure] Syntax
Parameter | Function |
|---|---|
Accept |
|
Profile | Specifies the name of a Steel-Belted Radius Carrier profile whose check list and return list attributes are applied to the user's connection. |
FullName | By indicating a FullName, Steel-Belted Radius Carrier returns a value in the class attribute, allowing for all [Failure] connections to be accounted. |
[Strip] Sections
The [Strip] sections (Table 155) of the SQL authentication configuration file (Table 155) allow User-Name stripping to occur. These sections enable Steel-Belted Radius Carrier to identify the username that the SQL database expects by stripping the incoming User-Name attribute value of realm names and other “decorations.”
You may or may not need to employ User-Name stripping for SQL authentication. Your need for this feature depends upon the naming conventions that you employ on your network and in your SQL database entries. The SBR Carrier usual name parsing features work independently of this feature.
The following [Strip] syntax is available to enable and configure User-Name stripping for SQL authentication:
[Strip] Authentication=Yes [StripPrefix] String String . . . [StripSuffix] String String . . .
Table 155: *.aut [Strip] Syntax
Parameter | Function |
|---|---|
Authentication |
|
[StripPrefix] | Lists strings that are to be stripped from the beginning of the UserName value. The strings are listed in order of priority. A string that appears earlier in the list takes precedence over later strings. In the following example, if the incoming UserName is seattleUser201, the stripped name is User201. If the incoming UserName is seatac2000, the stripped name is tac2000: [StripPrefix] seattle sea |
String | Each String that you provide in a [Strip] section may be a character string, or a regular expression according to the following rules: ? is a wildcard character. A dash (-) indicates a range of alphanumeric characters; brackets must enclose lists of characters or ranges. For example, [A-Za-z] means any letter and [0-9.,] means any number, including decimal points and commas. A backslash (\) followed by a non-alphanumeric character indicates that character literally, for example \’ indicates the question mark. \ is also used as an escape character: \a bell (7) \b backspace (8) \t tab (9) \n newline (10) \v vertical tab (11) \f formfeed (12) \r return (13) \xnn hex value, where nn are 2 hex digits \nnn decimal value, where nnn are 3 decimal digits |
[StripSuffix] | Lists strings that are to be stripped from the end of the User-Name value. Conventions are the same as for [StripPrefix]. |
Example: SQL Authentication Configuration File
This section provides an example of an Oracle radsql.aut configuration file.
[Bootstrap] Enable=0 LibraryName=radsql_auth_ora.so InitializationString=SQL-ORACLE [Settings] Connect=dBusername/dBpassword SQL=SELECT password, profile FROM userlist WHERE name = %name/40 ParameterMarker=? MaxConcurrent=1 ConcurrentTimeout=30 WaitReconnect=2 MaxWaitReconnect=360 PasswordFormat = 0 DefaultResults = 0 ;ShutdownTimeout=360 ErrorMap=oracle.ini LogLevel=0 [Server] s1=2 s2=2 [Server/s1] Connect=db_admin1/db_password1 [Server/s2] Connect=db_admin2/db_password2 [Results] Password=1/48 Profile=2/48 Alias=2/48 [Failure] Accept=0 Profile=xyz FullName=Remote User
