Chargeable-User-Identity (CUI) support.

1. OVERVIEW

This extension introduces support for Chargeable-User-Identity (CUI) attribute 
as defined in RFC 4372. 

The CUI attribute is meant to support roaming scenarios where
the user is accessing the network at one location (Service Provider - SP)
while authenticated by a RADIUS server at another institution (Identity
Provider - IdP). CUI provides means for the SP to request the IdP 
to return a unique, persistent, opaque user identifier.

As defined in RFC 4372, CUI request is sent as a NULL value (single
zero byte) of CUI attribute inside the Access-Request packet. 
CUI response should be sent as the CUI value inside the Access-Accept.

This extension has the following functionality:

The SP side (*requesting* CUI):
	- add the CUI NULL attribute to Access-Request proxied from 
	  the local NAS to the IdP
	- receive the CUI value from the IdP and store it in the local
	  database
	- update Accounting-Request packets sent by NAS by adding 
	  the appropriate CUI attribute (unless the attibute is 
	  already present).

The IdP side (*returning* CUI):
	- respond to the CUI request by generating the CUI value. 
	  The value is created as the md5 hash if a configurable local
	  salt and the User-Name attribute value.

While CUI support has been added for roaming it is also useful for local
accounting.

2. INSTALLATION

The CUI *requesting* and CUI *returning* sides are implemented and
described separately. Most likely you want to run both, so just follow
the instructions of both sections.

2.1 *requesting* CUI 

	- Setup a MySQL database by creating (or using) a database of your
	  choice and create an additional table cui. The schema is located
	  in ${raddbdir}/sql/mysql/cui.sql.

	- Enter the necessary details into ${raddbdir}/modules/cui.
	  Things you need to modify are: 
	    server - typically this will be localhost;
	    login - mysql user allowed to modify the tables
	    password - password for this user
	    radius_db - database name you wish to use
	    sp_operator_name - one of your registered DNS domain names, which
	         will be used as the Operator-Name attribute value

	- Modify the the main configuration file 
	  "${raddbdir}/sites-availabe/default".
	  Search for CUI. There are four sections where CUI is mentioned.
	  Follow the instructions for *requesting* the CUI.

2.2 *returning* CUI 

	- Modify the the main configuration file
	  "${raddbdir}/sites-available/default".
	  Search for CUI. There are four sections where CUI is mentioned.
  	  Follow the instructions for *returning* the CUI.
	  The cui_hash_key is used to safeguard the CUI from dictionary
	  attacks and should be set to some "random" string.

	- Modify "${raddbdir}/sites-availabe/inner-tunnel"
	  Search for CUI. There is one section where CUI is mentioned.
	  Follow the instructions for *returning* the CUI.

3. ACKNOWLEDGEMENTS

Authors: Maja Gorecka-Wolniewicz <mgw@umk.pl>, Alan DeKok

Contributors: Stefan Winter, Tomasz Wolniewicz
