FreeRADIUS + OpenLDAP for accounting
Hello everyone, I work for a mobile operator and we have a product (something like proxy) which is able to do so-called "Header Enrichment". A "mobile customer" who is connected over this proxy will have enriched his http header with phone number (MSISDN). A problem is that this proxy know IP address of customer instead of MSISDN and unfortunately cannot use a RADIUS to obtain the MSISDN from another source. This proxy is able to use only the LDAP request with IP of customer and then received the LDAP response from a external LDAP server which contain MSISDN (phone.num). Our network node (GGSN) have info about IP and MSISDN and can send both over RADIUS accounting. So I have to design a Accounting FreeRADIUS server which will store the RADIUS acconting with IP and MSISDN to OpenLDAP. And this "external" OpenLDAP server will provide MSISDN to proxy for "Header Enrichment". Is it appropriate to use FreeRADIUS with OpenLDAP or could you advise me how to combine everything for best performance and design? regards, Peter Micunek
Peter Micunek wrote:
So I have to design a Accounting FreeRADIUS server which will store the RADIUS acconting with IP and MSISDN to OpenLDAP.
That's not good. LDAP isn't really designed for large volumes of writes. I would suggest using an SQL database. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Peter Micunek wrote:
A problem is that this proxy know IP address of customer instead of MSISDN and unfortunately cannot use a RADIUS to obtain the MSISDN from another source. This proxy is able to use only the LDAP request with IP of customer and then
FreeRadius can't write to (account to) an LDAP directory. It's a fundamentally bad idea to do lots of writes to LDAP. Most LDAP servers are heavily read-optimised - not write. Can the proxy speak to an SQL server? If not, you could use an Exec-Program attribute in the "acct_users" file to run "ldapmodify"
The proxy cannot speak to an SQL server. Do you know some LDAP-SQL proxy which listen on LDAP server port and convert LDAP request to SQL and vice versa. Also, I am considering to use: NAS ---> FreeRADIUS (rlm_sql_mysql) ---> MySQL DB <---> OpenLDAP with slapd-sql <---> LDAP client what do you think about this? regards, Peter Micunek On 2/3/07, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
Peter Micunek wrote:
A problem is that this proxy know IP address of customer instead of MSISDN and unfortunately cannot use a RADIUS to obtain the MSISDN from another source. This proxy is able to use only the LDAP request with IP of customer and then
FreeRadius can't write to (account to) an LDAP directory.
It's a fundamentally bad idea to do lots of writes to LDAP. Most LDAP servers are heavily read-optimised - not write.
Can the proxy speak to an SQL server?
If not, you could use an Exec-Program attribute in the "acct_users" file to run "ldapmodify" - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Peter Micunek wrote:
The proxy cannot speak to an SQL server.
Why not?
Do you know some LDAP-SQL proxy which listen on LDAP server port and convert LDAP request to SQL and vice versa.
Huh? In one word: No.
Also, I am considering to use:
NAS ---> FreeRADIUS (rlm_sql_mysql) ---> MySQL DB <---> OpenLDAP with slapd-sql <---> LDAP client
Uh... no.
what do you think about this?
I think you're very confused about RADIUS, LDAP, and SQL. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Peter Micunek wrote:
The proxy cannot speak to an SQL server.
Then it's very poor software, and my advice would be to look elsewhere.
Do you know some LDAP-SQL proxy which listen on LDAP server port and convert LDAP request to SQL and vice versa.
OpenLDAP will do this, but it's not suitable for your needs (see below)
Also, I am considering to use:
NAS ---> FreeRADIUS (rlm_sql_mysql) ---> MySQL DB <---> OpenLDAP with slapd-sql <---> LDAP client
what do you think about this?
I am not an OpenLDAP expert any more, but the last time I investigated this you could not modify the SQL database "underneath" slapd-sql because of the servers caching. You had to make modifications via LDAP. If you really need FreeRadius accounting to perform an ldapadd/ldapmodify I suggest you use Exec-Program in the "acct_users" file, but be prepared for it to go slowly and break a lot.
regards, Peter Micunek
On 2/3/07, *Phil Mayers* <p.mayers@imperial.ac.uk <mailto:p.mayers@imperial.ac.uk>> wrote:
Peter Micunek wrote: > A problem is that this proxy know IP address of customer instead of > MSISDN and unfortunately cannot use a RADIUS to > obtain the MSISDN from another source. This proxy is able to use only > the LDAP request with IP of customer and then
FreeRadius can't write to (account to) an LDAP directory.
It's a fundamentally bad idea to do lots of writes to LDAP. Most LDAP servers are heavily read-optimised - not write.
Can the proxy speak to an SQL server?
If not, you could use an Exec-Program attribute in the "acct_users" file to run "ldapmodify" - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanx a lot I supposed this and definitely I will ask our vendor for modification of the interface regards, Peter Micunek On 2/3/07, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
Peter Micunek wrote:
The proxy cannot speak to an SQL server.
Then it's very poor software, and my advice would be to look elsewhere.
Do you know some LDAP-SQL proxy which listen on LDAP server port and convert LDAP request to SQL and vice versa.
OpenLDAP will do this, but it's not suitable for your needs (see below)
Also, I am considering to use:
NAS ---> FreeRADIUS (rlm_sql_mysql) ---> MySQL DB <---> OpenLDAP with slapd-sql <---> LDAP client
what do you think about this?
I am not an OpenLDAP expert any more, but the last time I investigated this you could not modify the SQL database "underneath" slapd-sql because of the servers caching. You had to make modifications via LDAP.
If you really need FreeRadius accounting to perform an ldapadd/ldapmodify I suggest you use Exec-Program in the "acct_users" file, but be prepared for it to go slowly and break a lot.
regards, Peter Micunek
On 2/3/07, *Phil Mayers* <p.mayers@imperial.ac.uk <mailto:p.mayers@imperial.ac.uk>> wrote:
Peter Micunek wrote: > A problem is that this proxy know IP address of customer instead
of
> MSISDN and unfortunately cannot use a RADIUS to > obtain the MSISDN from another source. This proxy is able to use
only
> the LDAP request with IP of customer and then
FreeRadius can't write to (account to) an LDAP directory.
It's a fundamentally bad idea to do lots of writes to LDAP. Most
LDAP
servers are heavily read-optimised - not write.
Can the proxy speak to an SQL server?
If not, you could use an Exec-Program attribute in the "acct_users" file to run "ldapmodify" - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Peter Micunek -
Phil Mayers