Authentication Process/Flowchart

[Walt Reynolds]

Anyone want to comment before I add it to the wiki?  No use adding it if 
it is that far off.

Peter Nixon wrote:
> Hi Walt
> 
> If you were to put this in the wiki you may even have other people help you 
> edit it ;-)
> 
> Peter
> 
> On Fri 02 Mar 2007 22:37, Walt Reynolds wrote:
>> I have searched, but did not find what I was looking for, so trying to
>> do my own flowchart of the process.  Below is a written up flow that I
>> want to try and convert to a graphical one.  Can I please get some
>> feedback on if this is not only the way it really works, but also if it
>> is accurate.
>>
>> If someone has something like this I would be very grateful if you would
>> pass it along to me.  Just remember plagiarisms is the greatest form of
>> flattery (I would give you credit either way if you wanted)
>>
>> Thanks.
>>
>> ========================================
>> 1. Request comes in (example)
>> User-Name = "Guest2 at location.com"
>> User-Password = "Password"
>> NAS-IP-Address = 192.168.224.36
>> Service-Type = Login-User
>> Framed-IP-Address = 198.168.225.72
>> Called-Station-Id = "00:07:E9:D1:8F:C2"
>> Calling-Station-Id = "00:40:96:a7:00:14"
>> NAS-Identifier = "box.lab"
>> Acct-Session-Id = "00:07:E9:D1:8F:C2:117165661771"
>> NAS-Port-Type = Wireless-802.11
>>
>> 2. Looks in the authorize section of radius.conf
>> ## authorize actually means is this request authorized to authenticate
>> ##(does it match rules)
>> preprocess 	##This looks a the following files to add/coorelate
>> 		##the request to rules defined in later modules.
>> 			huntgroups
>> 				##Matches based on NAS
>> 			hints
>> 				##Matches on user
>> auth_log	##This defines where the log will be
>> suffix 		##Defined as deliminater for proxying realms
>> 			## Finds realm (if listed, if so will be used
>> 			##starting in preproxy_users
>> eap		##Set to define and perform EAP authentication (if in 				##request)
>> files		## Looks at the following files:
>> 			users
>> 				##Used to decide how to AuthZ and AuthN 					##users.  Check items,
>> if matched will
>> 				##add reply info to NAS
>> 				##if no specific match, will match 						##DEFAULT
>> 				##User could move to
>> 			acct_users
>> 				##Same as users file but for accounting.
>> !!!***!!!If there is no realm defined at this part, it will
>>
>> 			preproxy_users
>> 				##Matches like users, but reply items
>> 				##added to proxied request to new NAS
>> 			pre_proxy_log
>> 				##Allows you to log the pre-proxied
>> 				##request
>>
>> 3. Sent proxy request to radius server listed in proxy.conf if it did
>> find a realm match (based on suffix/px....
>> 4. Receives reply
>> 	a. Looks at post_proxy
>> 			post_proxy_log
>> 				##Logs post proxy info if enabled
>> 			attr_filter
>> 				##Allows you to filter what the proxied
>> 				##server sends back to NAS
>> 5. Sends Accept/Deny to NAS (with all attributes added or filtered)
>> 6. Accounting ----
> 

-- 
Walt Reynolds
Principle Systems Security Development Engineer
Information Technology Central Services
University of Michigan
(734) 615-9438