Introduction
Introduction –
Basic usage of Auth_RADIUS
What is Auth_RADIUS?
Auth_RADIUS is a php wrapper around the php radius extension. If you are unfamiliar with the RADIUS protocol, the Wikipedia article provides an excellent introduction.
Auth_RADIUS is structured around the facilities built into the radius extension. Understanding Auth_RADIUS generally first requires a basic understanding of how the radius extension is designed. Documentation of the radius extension is available through the PHP manual at http://www.php.net/radius
There are different Classes for the different authentication methods available through RADIUS. If you are using CHAP-MD5 or MS-CHAP authentication, you will also need the Crypt_CHAP package. In addition, if using MS-CHAP authentication, you will need to enable the mhash and mcrypt extension in php.ini, or compile them in statically.
Note that if you have the latest radius extension (version 1.2 or newer), you will not need to enable the mcrypt extension.
How do I use Auth_RADIUS?
Basic usage examples follow, pulled from the package itself.
<?php
/* vim: set expandtab tabstop=4 shiftwidth=4: */
/*
Copyright (c) 2003, Michael Bretterklieber <michael@bretterklieber.com>
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. The names of the authors may not be used to endorse or promote products
derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This code cannot simply be copied and put under the GNU Public License or
any other GPL-like (LGPL, GPL2) License.
$Id: intro.xml,v 1.4 2008-10-09 15:16:20 cweiske Exp $
*/
require_once 'Auth/RADIUS.php';
require_once 'Crypt/CHAP.php';
//$type = 'PAP';
//$type = 'CHAP_MD5';
$type = 'MSCHAPv1';
//$type = 'MSCHAPv2';
$username = 'sepp';
$password = 'sepp';
$classname = 'Auth_RADIUS_' . $type;
$rauth = new $classname($username, $password);
$rauth->addServer('localhost', 0, 'testing123');
$rauth->setConfigfile('/etc/radius.conf');
$rauth->username = $username;
switch($type) {
case 'CHAP_MD5':
case 'MSCHAPv1':
$classname = $type == 'MSCHAPv1' ? 'Crypt_CHAP_MSv1' : 'Crypt_CHAP_MD5';
$crpt = new $classname;
$crpt->password = $password;
$rauth->challenge = $crpt->challenge;
$rauth->chapid = $crpt->chapid;
$rauth->response = $crpt->challengeResponse();
$rauth->flags = 1;
// If you must use deprecated and weak LAN-Manager-Responses use this:
// $rauth->lmResponse = $crpt->lmChallengeResponse();
// $rauth->flags = 0;
break;
case 'MSCHAPv2':
$crpt = new Crypt_CHAP_MSv2;
$crpt->username = $username;
$crpt->password = $password;
$rauth->challenge = $crpt->authChallenge;
$rauth->peerChallenge = $crpt->peerChallenge;
$rauth->chapid = $crpt->chapid;
$rauth->response = $crpt->challengeResponse();
break;
default:
$rauth->password = $password;
break;
}
if (!$rauth->start()) {
printf("Radius start: %s<br>\n", $rauth->getError());
exit;
}
$result = $rauth->send();
if (PEAR::isError($result)) {
printf("Radius send failed: %s<br>\n", $result->getMessage());
exit;
} else if ($result === true) {
printf("Radius Auth succeeded<br>\n");
} else {
printf("Radius Auth rejected<br>\n");
}
// get attributes, even if auth failed
if (!$rauth->getAttributes()) {
printf("Radius getAttributes: %s<br>\n", $rauth->getError());
} else {
$rauth->dumpAttributes();
}
$rauth->close();
?>
Here is the second example:
<?php
/* vim: set expandtab tabstop=4 shiftwidth=4: */
/*
Copyright (c) 2003, Michael Bretterklieber <michael@bretterklieber.com>
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. The names of the authors may not be used to endorse or promote products
derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This code cannot simply be copied and put under the GNU Public License or
any other GPL-like (LGPL, GPL2) License.
$Id: intro.xml,v 1.4 2008-10-09 15:16:20 cweiske Exp $
*/
require_once 'Auth/RADIUS.php';
require_once 'Crypt/CHAP.php';
$username = 'sepp';
$starttime = time();
$racct = new Auth_RADIUS_Acct_Start;
$racct->addServer('localhost', 0, 'testing123');
$racct->username = $username;
// RADIUS_AUTH_RADIUS => authenticated via Radius
// RADIUS_AUTH_LOCAL => authenicated local
// RADIUS_AUTH_REMOTE => authenticated remote
$racct->authentic = RADIUS_AUTH_LOCAL;
$status = $racct->start();
if(PEAR::isError($status)) {
printf("Radius start: %s<br>\n", $status->getMessage());
exit;
}
// you can put any additional attributes here
// $racct->putAttribute(RADIUS_ACCT_INPUT_PACKETS, 45236);
// $racct->putAttribute(RADIUS_ACCT_OUTPUT_PACKETS, 1212);
$result = $racct->send();
if (PEAR::isError($result)) {
printf("Radius send failed: %s<br>\n", $result->getMessage());
exit;
} else if ($result === true) {
printf("Radius Acounting succeeded<br>\n");
} else {
printf("Radius Acounting rejected<br>\n");
}
$racct->close();
// Wait a bit, that we can put the session-time
sleep(2);
// send an accounting update
$racct = new Auth_RADIUS_Acct_Update;
$racct->addServer('localhost', 0, 'testing123');
$racct->username = $username;
$racct->session_time = time() - $starttime;
$status = $racct->start();
if(PEAR::isError($status)) {
printf("Radius start: %s<br>\n", $status->getMessage());
exit;
}
$result = $racct->send();
if (PEAR::isError($result)) {
printf("Radius send failed: %s<br>\n", $result->getMessage());
exit;
} else if ($result === true) {
printf("Radius Acounting succeeded<br>\n");
} else {
printf("Radius Acounting rejected<br>\n");
}
// Wait a bit, that we can put the session-time
sleep(2);
// send the stop
$racct = new Auth_RADIUS_Acct_Stop;
$racct->addServer('localhost', 0, 'testing123');
$racct->username = $username;
$racct->session_time = time() - $starttime;
$status = $racct->start();
if(PEAR::isError($status)) {
printf("Radius start: %s<br>\n", $status->getMessage());
exit;
}
// you can put any additional attributes here
// $racct->putAttribute(RADIUS_ACCT_TERMINATE_CAUSE, RADIUS_TERM_SESSION_TIMEOUT);
$result = $racct->send();
if (PEAR::isError($result)) {
printf("Radius send failed: %s<br>\n", $result->getMessage());
exit;
} else if ($result === true) {
printf("Radius Acounting succeeded<br>\n");
} else {
printf("Radius Acounting rejected<br>\n");
}
$racct->close();
?>