	RADIUS Authentication Modules
	Version 1.2 2003/05/28
	
	Author: Michal Zygmuntowicz <m.zygmuntowicz@onet.pl>


	Table of Contents:
	1. Introduction
	2. Compilation
	3. RadAuth - H.235 Username/Password Authentication
	3.1. RadAuth RADIUS Attributes
	4. RadAliasAuth - Alias Based Authentication
	4.1. RadAliasAuth RADIUS Attributes
	5. TODO
	6. List of files


1. Introduction
---------------

This RADIUS authentication package consists of two
authentication modules - one for H.235 username/password
based scheme and the other for alias based authentication.


2. Compilation
---------------

By default, RADIUS support is compiled as other regular
modules. In order to disable compilation of these RADIUS modules, 
NO_RADAUTH has to be defined. Example:

	NO_RADAUTH=1 make opt

To disable RADIUS modules compilation under Windows, 
radauth.cxx and radproto.cxx have to be manually excluded
from the build.


3. RadAuth - H.235 Username/Password Authentication
---------------------------------------------------

This modules provides authentication based on H.235
security features. It requires endpoints to include
CATs (Cisco Access Tokens) with username/password 
inside RRQs and ARQs sent.


3.1. RadAuth RADIUS Attributes
------------------------------

For RRQs, the following RADIUS attributes are included
inside Access-Request packets (* means optional):

	User-Name - H225_RegistrationRequest.tokens[CAT].m_generalID
	CHAP-Password - H225_RegistrationRequest.tokens[CAT].m_random 
					+ H225_RegistrationRequest.tokens[CAT].m_challenge
	CHAP-Challenge - H225_RegistrationRequest.tokens[CAT].m_timeStamp
	NAS-IP-Address - GNU Gk Home or a particular local network interface set
					by 'LocalInterface' config parameter
	NAS-Port-Type - Virtual (GNU Gk does not have concept of physical ports)
	NAS-Identifier - GNU Gk Name
	*Framed-IP-Address - IP address of registering endpoint signalling channel 
						(only if IncludeEndpointIP config option is set)
	Service-Type - Login-User
	
For ARQs, the following RADIUS attributes are included
inside Access-Request packets (* means optional):

	User-Name - ARQ.tokens[CAT].m_generalID
	CHAP-Password - ARQ.tokens[CAT].m_random + ARQ.tokens[CAT].m_challenge
	CHAP-Challenge - ARQ.tokens[CAT].m_timeStamp
	NAS-IP-Address - GNU Gk Home or a particular local network interface set
					by 'LocalInterface' config parameter
	NAS-Port-Type - Virtual (GNU Gk does not have concept of physical ports)
	NAS-Identifier - GNU Gk Name
	*Framed-IP-Address - IP address of registering endpoint signalling channel 
						(only if IncludeEndpointIP config option is set)
	Service-Type - Login-User (for ARQs from originating endpoint)
					or Call-Check (for ARQs from answering endpoint)
	
	Calling-Station-Id - one of:
							ARQ.m_srcInfo (dialedDigits or partyNumber
								or h323id, in order the preceeding order)
							first dialedDigits, partyNumber or h323_ID alias
								from the list of registered aliases for originating ep
							the same as User-Name (only if requesting
								endpoint is the one that is originating 
								the call - ARQ.m_answerCall is FALSE).
	Called-Station-Id - one of:
							ARQ.m_destinationInfo (dialedDigits or partyNumber
								or h323id, in order the preceeding order)
							first dialedDigits, partyNumber or h323_ID alias
								from the list of registered aliases for answering ep
							ARQ.m_destCallSignalAddress::e_ipAddress.
							the same as User-Name (only if requesting
								endpoint is the one that is answering 
								the call - ARQ.m_answerCall is FALSE).

	*VSA: VendorId=Cisco, h323-conf-id - H.323 conference ID from ARQ;
	*VSA: VendorId=Cisco, h323-call-type - call type (fixed value: "h323-call-type=VoIP");
	*VSA: VendorId=Cisco, h323-call-origin - call origin ("answer","originate");
	*VSA: VendorId=Cisco, h323-gw-id - the same as NAS-Identifier;


4. RadAliasAuth - Alias Based Authentication
--------------------------------------------

This modules provides authentication based on endpoint
aliases and/or endpoint signalling address. RadAliasAuth 
can be configured to include fixed username and/or fixed
user password.


4.1. RadAliasAuth RADIUS Attributes
-----------------------------------

For RRQs, the following RADIUS attributes are included
inside Access-Request packets (* means optional):

	User-Name - either endpoint alias from RRQ or a value of FixedUsername 
				config parameter. User-Name is taken as follows:
					FixedUsername or
					RRQ.m_terminalAlias (preference order: h323_ID, dialedDigits) or
					RRQ.m_callSignalAddress or
					RRQ.m_rasAddress or
					RRQ.m_endpointIdentifier;
	User-Password - either the same as User-Name or a value of FixedPassword
					config parameter
	NAS-IP-Address - GNU Gk Home or a particular local network interface set
					by 'LocalInterface' config parameter
	NAS-Port-Type - Virtual (GNU Gk does not have concept of physical ports)
	NAS-Identifier - GNU Gk Name
	*Framed-IP-Address - IP address of registering endpoint signalling channel 
						(only if IncludeEndpointIP config option is set)
	Service-Type - Login-User
	
For ARQs, the following RADIUS attributes are included
inside Access-Request packets (* means optional):

	User-Name - either endpoint alias from ARQ or a value of FixedUsername 
				config parameter. User-Name is taken as follows:
					FixedUsername or
					first endpoint alias from registration table 
						(preference order: h323_ID, dialedDigits) or
					ARQ.m_srcInfo (preference order: h323_ID, dialedDigits) or
					ARQ.m_srcCallSignalAddress or
					call signalling address from registration table or
					ARQ.m_endpointIdentifier;
	User-Password - either the same as User-Name or a value of FixedPassword
					config parameter
	NAS-IP-Address - GNU Gk Home or a particular local network interface set
					by 'LocalInterface' config parameter
	NAS-Port-Type - Virtual (GNU Gk does not have concept of physical ports)
	NAS-Identifier - GNU Gk Name
	*Framed-IP-Address - IP address of registering endpoint signalling channel 
						(only if IncludeEndpointIP config option is set)
	Service-Type - Login-User (for ARQs from originating endpoint)
					or Call-Check (for ARQs from answering endpoint)
	
	Calling-Station-Id - one of:
							ARQ.m_srcInfo (dialedDigits or partyNumber
								or h323id, in order the preceeding order)
							first dialedDigits, partyNumber or h323_ID alias
								from the list of registered aliases for originating ep
							the same as User-Name (only if requesting
								endpoint is the one that is originating 
								the call - ARQ.m_answerCall is FALSE).
	Called-Station-Id - one of:
							ARQ.m_destinationInfo (dialedDigits or partyNumber
								or h323id, in order the preceeding order)
							first dialedDigits, partyNumber or h323_ID alias
								from the list of registered aliases for answering ep
							ARQ.m_destCallSignalAddress::e_ipAddress.
							the same as User-Name (only if requesting
								endpoint is the one that is answering 
								the call - ARQ.m_answerCall is FALSE).

	*VSA: VendorId=Cisco, h323-conf-id - H.323 conference ID from ARQ;
	*VSA: VendorId=Cisco, h323-call-type - call type (fixed value: "h323-call-type=VoIP");
	*VSA: VendorId=Cisco, h323-call-origin - call origin ("answer","originate");
	*VSA: VendorId=Cisco, h323-gw-id - the same as NAS-Identifier;

		
5. TODO
-------

	* Better ARQ handling (more attributes, etc.)
	* Other authentication methods to CAT - CryptoEPPwdHash, etc.
		- is it possible without modifying RADIUS server logic?
	* DRQ, BRQ handling;
	* Authorization support (acount balance, call limit, etc.);

	
6. List of files
----------------

	openh323gk/radproto.cxx - RADIUS protocol generic client
	openh323gk/radproto.h 
	openh323gk/radauth.cxx - Authenticator for GNU Gk
	openh323gk/radauth.h
	openh323gk/etc/radauth.ini - example RadAuth configuration
	openh323gk/etc/radaliasauth.ini - example RadAliasAuth configuration
	openh323gk/docs/radauth.txt - documentation
