RADIUS Authentication
Starting in 3.0, ProVision supports 6connect vendor-specific attributes (VSAs) for use with RADIUS authentication. To use these attributes, you must perform the following procedures:
Table of Contents |
---|
Add the 6connect VSA to the Radius Installation
To use the 6connect VSA, the attributes must be defined on the RADIUS server. Add the following RADIUS dictionary file to your RADIUS server and name it dictionary.6connect:
Important Note: Between version 3.9.3 and 4.0, the permissions structure for ProVision was significantly changed. Make sure you following the version specific instructions below.
ProVision 3.9.3 and prior:
Expand | |||||
---|---|---|---|---|---|
|
ProVision 4.0 and greater:
Expand | ||
---|---|---|
|
Note |
---|
Make sure to add the following to the primary dictionary file: $INCLUDE dictionary.6connect |
Configure Radius Accounts
On the Radius server, configure the user accounts that will have access to the ProVision system.
An example of a ProVision account configuration for the user file on a Freeradius system for version 3.9.3 and prior:
Code Block |
---|
#A user with full IPAM prvileges and view only DNS privs
joe Cleartext-Password := "testing128"
priv_admin = 1,
priv_ipam_v = 1,
priv_ipam_c = 1,
priv_ipam_d = 1,
priv_ipam_m = 1,
priv_swip = 1,
priv_email = 1,
priv_dns_v = 1 |
An example of a ProVision account configuration for the user file on a Freeradius system for version 4.0 and greater:
Example: To To add a new radius user, edit the 'users' file found at /etc/raddb/users and add a block like:
Code Block | ||||
---|---|---|---|---|
| ||||
bobber Cleartext-Password := "hello" 6connect_user_group = "Global Admins,Group 2,Group 1,Group Nonexistant" |
The Radius server must be restarted every time you add, remove, or modify users. To restart the Radius server, use this command:
Code Block |
---|
/etc/init.d/radiusd restartNonexistent" |
Note | ||
---|---|---|
| ||
There are many Radius attributes, but '6connect_user_group' is the one used by 6connect ProVision . It and it is just a comma-separated list of all the group names that the user belongs to. |
Test Radius Accounts
For ProVision 4.0 and higher3.9.3 and prior, test and response should look like the following:
To query a radius server, use the following command format:
Code Block | ||
---|---|---|
| ||
radtest#>radtest [USERNAME] [USERPASSWORD] [SERVER] 0 [SECRET] |
Example:
Code Block |
---|
radtest bobber hello 208.39.140.106 0 6connect |
A successful response will look like this:
Code Block | ||
---|---|---|
| ||
test test 50.23.215.162 6connect Sending Access-Request of id 198179 to 20850.3923.140215.106162 port 1812 User-Name = "bobbertest" User-Password = "hellotest" NAS-IP-Address = 6710.221124.24047.2296 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 20850.3923.104215.106162 port 1812, id=198179, length=6968 Attr-10 = 0x476c6f62616c2041646d696e732c47726f757020322c47726f757020312c47726f7570204e6f6e6578697374616e74 |
A rejected response may look like this:
...
language | text |
---|
...
priv_admin = 1
priv_ipam_c = 1
priv_ipam_m = 1
priv_ipam_d = 1 |
For 4.0 and higher, test and response should look like the following:
﹤insert example﹥
Configure ProVision for Radius Authentication
To configure the use of Radius authentication with ProVision, follow the steps below.
- Log into 6connect ProVision
- Go to Admin -> ﹥ General Settings -﹥ Authentication
- Ensure that Radius functions are marked as available. Radius functions are always available on 6connect cloud instances. Radius functions are available on VM Images and Local Installations only if the relevant PHP Pear Radius Libraries have been installed.
- Click the Radius Enable checkbox.
- Fill in the hostname or ip address, authentication ports, accounting port, and shared Radius key as specified.
Note | ||
---|---|---|
| ||
In the login screen, you would select the authentication method from the dropdown. If you like, you can set the default login option in the following way: Go to the /data/globals.php and open in vi (or other editor). Add in the following text as the last line of the file (before the closing ?>﹥) define('DEFAULT_LOGIN_TYPE', 'radius'); |