Subject: [Sip] Authentication through WDS.

From: "Anand Kumaravel, TLS-Chennai" <[email-masked]>
Date: Tue, 7 Aug 2007 10:28:39 +0530

Hi All,

            We are planning to integrate authentication mechanism in SIP
with Windows Active Directory (WDS).

Such that, when an UA sends its digest response for incoming 401/407,
the proxy in some mechanism has to contact the active directory to
confirm the authentication of the user. 

But SIP supports authentication through digest and we are not sure
whether the same is supported by WDS and we also learnt that WDS will
not give the password but will only conform the correctness of the
password given.

It will be helpful if anyone can through some light on how this can be
achieved.

Thanks in advance,

Anand,

DISCLAIMER:
-----------------------------------------------------------------------------------------------------------------------

The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only.
It shall not attach any liability on the originator or HCL or its affiliates. Any views or opinions presented in 
this email are solely those of the author and may not necessarily reflect the opinions of HCL or its affiliates.
Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of 
this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have 
received this email in error please delete it and notify the sender immediately. Before opening any mail and 
attachments please check them for viruses and defect.

-----------------------------------------------------------------------------------------------------------------------

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Miguel Garcia <[email-masked]>
Date: Tue, 07 Aug 2007 10:53:00 +0300

Anand:

I know little about the Windows Active Directory, but perhaps I can 
throw some information that may give you some ideas.

Deployments are using two centralized authentication servers: RADIUS or 
Diameter servers.

When using a RADIUS/Diameter server, a SIP proxy server acts as a 
RADIUS/Diameter client, contacts the RADIUS/Diameter server with the 
user's credentials, which authenticates the user, and provides the 
appropriate response.

The documents to look at are:

- RFC 4590: RADIUS Extension for Digest Authentication
- RFC 4740: Diameter SIP Application.

I think are you looking at replacing any of these two RFCs by whatever 
protocol the Windows Active Directory use.

/Miguel

Anand Kumaravel, TLS-Chennai wrote:
> The contents of this e-mail and any attachment(s) are confidential and 
> intended for the named recipient(s) only.
> It shall not attach any liability on the originator or HCL or its 
> affiliates. Any views or opinions presented in
> this email are solely those of the author and may not necessarily 
> reflect the opinions of HCL or its affiliates.
> Any form of reproduction, dissemination, copying, disclosure, 
> modification, distribution and / or publication of
> this message without the prior written consent of the author of this 
> e-mail is strictly prohibited. If you have
> ------------------------------------------------------------------------
> 

-- 
Miguel A. Garcia           tel:+358-50-4804586
Nokia Siemens Networks     Espoo, Finland

---

From: "Beck01, Wolfgang" <[email-masked]>
Date: Tue, 7 Aug 2007 16:56:07 +0200

Anand wrote:

> We are planning to integrate authentication mechanism in SIP with
Windows Active Directory (WDS).
WDS seems to be based on LDAP.

http://www.apan.net/meetings/tokyo2006/presentation/ser-auth-radius-ldap
.pdf

describes a setup where the SIP proxy queries a RADIUS server
(using RfC 4590 or an early version of the draft), which queries
an LDAP server for the password.

It might be possible to use FreeRadius with WDS that way.

Not the most elegant solution.

Wolfgang