embedaddon/mpd/doc/mpd32.html - view

File: [ELWIX - Embedded LightWeight unIX -] / embedaddon / mpd / doc / mpd32.html
Revision 1.1.1.2 (vendor branch): download - view: text, annotated - select for diffs - revision graph
Mon Jul 22 08:44:30 2013 UTC (11 years, 5 months ago) by misho
Branches: mpd, MAIN
CVS tags: v5_7p0, v5_7, HEAD

5.7

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <TITLE>Dynamic Authorization</TITLE> </HEAD> <BODY text="#000000" bgcolor="#ffffff"> <A HREF="mpd.html">Mpd 5.7 User Manual</A> : <A HREF="mpd17.html">Configuring Mpd</A> : Dynamic Authorization  Previous: <A HREF="mpd31.html">External authentication</A>  Next: <A HREF="mpd33.html">Traffic accounting</A> <HR NOSHADE> <H2><A NAME="32"></A>4.11. Dynamic Authorization<A NAME="dynauth"></A></H2> After session has been first time authorized by AAA subsystem, Mpd provides you several ways to affect it's further operation. Process of affecting established session called dynamic authorization. There are two types of dynamic authorization activities exist: Disconnect (terminate session, causing it's graceful shutdown) and Change of Authorization, CoA (changing session operation parameters, such as speed, ACLs and so on, on-flight)  <dl> Mpd provides several different control interfaces, that can be used to implement dynamic authorization. <dt>Control consoles<dd>The basic method of controlling mpd is it's STDIN and TCP  <A HREF="mpd40.html#console">console</A>. You can disconnect any session by connecting to console, selecting required session with any command for changing current context, such as: link, bundle, session, msession and so on, and using close command. <dt>Web server<dd>Mpd provides two  <A HREF="mpd41.html#web">web</A> interfaces: human (text/html) and binary (text/plain). Human web interface allows you disconnect specified session just by clicking on respective [Close] link on the "Current status summary" web page on mpd built-in web server. Binary web interface provides API for executing any of control console commands via HTTP request. For example, to disconnect session on link named L125 you may use such HTTP request: /bincmd?link%20L125&close <dt>RADIUS accounting<dd>Mpd provides simple, but non-standard method of disconnecting session using  <A HREF="mpd30.html#radius">radius</A> accounting reply. To disconnect arbitrary session you may just include mpd-drop-user attribute with nonzero value into any accounting reply packet. This method considered not to be completely reliable, as AAA receives no acknowledge that accounting reply packet was received by mpd. The only thing guarantied, is that on packet loss mpd will retry accounting sending for specified number of times before giveup. <dt>Built-in RADIUS server<dd>RFC 3576: "Dynamic Authorization Extensions to RADIUS" defines standard way to implement dynamic authorization. It defines two additional RADIUS request types: Disconnect-Request and CoA-Request, to be sent from AAA server to dedicated UDP port on NAS with regular RADIUS protocol. To have this function working, mpd should be built with libradius library, having RADIUS server functionality (FreeBSD 7/8-STABLE after 2009-10-30). This chapter describes commands that configure mpd's built-in RADIUS server. All of these commands are executed in global context.  <dl> <dt><code>set radsrv open</code><dd>Opens the RADIUS server, i.e., creates the listening UDP socket. <dt><code>set radsrv close</code><dd>Closes the RADIUS server, i.e., closes the listening UDP socket. <dt><code>set radsrv self ip [ port ]</code><dd>Sets the credentials for the RADIUS-listener. After changing one of these options, the RADIUS server must be closed and re-opened for the changes to take effect. The default is '0.0.0.0 3799'. <dt><code>set radsrv peer ip secret</code><dd>Defines additional AAA server, allowed to contact this NAS. After changing one of these options, the RADIUS server must be closed and re-opened for the changes to take effect. <dt><code>set radsrv enable option ...  set radsrv disable option ...</code><dd>These commands configure various RADIUS server options. The <code>enable</code> and <code>disable</code> commands determine whether we want the corresponding option. The options available for the RADIUS server are: <dt><code>coa</code><dd>This option enables CoA-Request support on RADIUS server. The default is enable. <dt><code>disconnect</code><dd>This option enables Disconnect-Request support on RADIUS server. The default is enable. </dl> Dynamic authorization RADIUS server receives three groups of attributes: NAS identification (to be sure that request got to the right server), session identification (to identify session that should be affected) and session parameters (to describe new session state to set). NAS and session identification attributes are native part of any Disconnect or CoA request, while session parameters could be used only with CoA. At least one session identification attribute must be present in request. If there are several identification attributes present, session should match all of them to be affected. NAS identification attributes supported by mpd: <pre> N Name 4 NAS-IP-Address </pre>  Session identification attributes supported by mpd: <pre> N Name 1 User-Name 5 NAS-Port 8 Framed-IP-Address 30 Called-Station-Id 31 Calling-Station-Id 44 Acct-Session-Id 50 Acct-Multi-Session-Id mpd VSA (12341) 12 mpd-link 13 mpd-bundle 14 mpd-iface 15 mpd-iface-index </pre>  Session parameters attributes supported by mpd: <pre> N Name 24 State 25 Class 27 Session-Timeout 28 Idle-Timeout 85 Acct-Interim-Interval mpd VSA (12341) 1 mpd-rule 2 mpd-pipe 3 mpd-queue 4 mpd-table 5 mpd-table-static 7 mpd-filter 8 mpd-limit 16 mpd-input-acct 17 mpd-output-acct </pre>  Received in CoA session parameters replace existing ones. If some parameter is not received, it keeps it's previous value for standard attributes, and getting cleared for mpd's VSAs. Nots, that CoA request always restarts Session and Idle timers for matching interfaces, and restarts Accounting Update timer for matching links, if new value received. </dl>  <HR NOSHADE> <A HREF="mpd.html">Mpd 5.7 User Manual</A> : <A HREF="mpd17.html">Configuring Mpd</A> : Dynamic Authorization  Previous: <A HREF="mpd31.html">External authentication</A>  Next: <A HREF="mpd33.html">Traffic accounting</A> </BODY> </HTML>