NetApp vendor-specific attributes

About vendor-specific attributes

Vendor-specific attributes enable vendors to support their own extended attributes that are not suitable for general RADIUS use. The dictionary files of the RADIUS servers that will use NetApp's vendor-specific attributes must be configured with NetApp's set of vendor-specific attributes. If the RADIUS server receives a vendor-specific attribute from the NetCache appliance but has no entry in its dictionary file, the server ignores the data.

Types common to all NetApp RADIUS extensions are

Vendor-specific attribute type: 26
NetApp vendor ID: 789

Packet requirements

The following table shows requirements for Access-Accept and Access-Reject packets.

Packet type	Requirements
Access-Accept	They must contain a user-name attribute if IP authentication is enabled. They can contain vendor-specific attributes, for example, a request URL. The RADIUS server can send a new host name or a new URL to NetCache. (The RADIUS server knows what the client has requested.) However, if IP authentication is not enabled on the appliance, the appliance ignores the new host name or new URL.
Access-Reject	The following requirements apply only when IP authentication is enabled on the appliance. That is, if the Send URL option is enabled on the appliance without IP authentication, these requirements do not apply. They must contain a vendor-specific reject type that maps to a NetApp vendor-specific reject-type. Note: This requirement does not conform to RFC 2865. They must contain a reply message. The reply message varies according to the streaming media protocol. For RTSP, NetCache can pass on a text message from the RADIUS server that describes the problem to the user. For MMS, the user sees a generic Windows Media error message.

Packet type

Requirements

Access-Accept

They must contain a user-name attribute if IP authentication is enabled.
They can contain vendor-specific attributes, for example, a request URL. The RADIUS server can send a new host name or a new URL to NetCache. (The RADIUS server knows what the client has requested.) However, if IP authentication is not enabled on the appliance, the appliance ignores the new host name or new URL.

Access-Reject

The following requirements apply only when IP authentication is enabled on the appliance. That is, if the Send URL option is enabled on the appliance without IP authentication, these requirements do not apply.

They must contain a vendor-specific reject type that maps to a NetApp vendor-specific reject-type.
Note: This requirement does not conform to RFC 2865.
They must contain a reply message.
The reply message varies according to the streaming media protocol. For RTSP, NetCache can pass on a text message from the RADIUS server that describes the problem to the user. For MMS, the user sees a generic Windows Media error message.

Vendor-Netapp-1

Contained in

Access-Request

Format

String

Vendor-specific-attribute type

Description

Contains the complete requested URL. The maximum length of the URL that NetCache sends depends on the remaining space in the packet after NetCache inserts the following into the packet:

User-Name
User-Password
NAS-IP-Address
Calling-Station-ID
Vendor-Netapp.2

The current total packet length is 1,000 bytes.

If the Send URL option on the NetCache appliance Authentication - RADIUS page is configured, the RADIUS server must recognize Vendor-Netapp-1 if it is to process the URL. (To access the Send URL option, select Setup tab > Authentication > RADIUS > Extensions tab.)

Vendor-Netapp-2

Contained in

Access-Request

Format

Integer

Vendor-specific-attribute type

Possible values

1 or 2. A value of 1 is for the IP address. A value of 2 is for user/password authentication.

Description

Describes the contents of the User-Name and User-Password fields.

If NetCache sends to the RADIUS server...	Then...
A value of 1 for Vendor-Netapp-2	The User-Name is set to "NetCache" and the User-Password is set to an encrypted representation of a configured NetCache password (IP Authentication Password or, in the CLI, config.auth.radius.ip_authenticate.pass). Authentication will then be performed on the basis of Calling-Station-ID.
A value of 2 for Vendor-Netapp-2	Per-user information is contained in the User-Name and User-password encrypted fields, which will be used for authentication. (The fields are encrypted according to RFC 2865.)

The client IP address stored in the Calling-Station-ID will be encoded as a dotted decimal string, for example, 10.10.10.1.

Vendor-Netapp-3

Contained in

Access-Reject

Format

Integer

Vendor-specific-attribute type

Possible values

1, 2, or 3

Description

Action that NetCache takes based on the value returned by the RADIUS server.

Value	RADIUS server result	NetCache determination of action to take based on value
1	Authentication failed	Prompt for user name and password if prompting has not already occurred
2	Authorization failed	Send a Reply-Message to the client
3	Other (not categorized by a value of 1 or 2)	Deny the request

Vendor-Netapp-4

Contained in

Access-Accept

Format

String

Vendor-specific-attribute type

Description

Contains the new origin server host name or IP address in dotted decimal notation.

If NetCache receives this attribute from the RADIUS server, NetCache rewrites the host name portion of the original URL to use the host name that was sent. If the RADIUS server does not send this attribute, NetCache does nothing.

If NetCache is configured for IP authentication, NetCache will look for User-Name, Class, and either the Vendor-Netapp-4 or Vendor-Netapp-5 attribute. The RADIUS server can send either Vendor-Netapp-4 or Vendor-Netapp-5, but not both.

If you are using RADIUS extensions for access control in a scenario such as in Scenario: Using the IP authentication feature for access control by URL, the RADIUS server should send Vendor-Netapp-4 or Vendor-Netapp-5.

Vendor-Netapp-5

Contained in

Access-Accept

Format

String

Vendor-specific-attribute type

Description

Contains the complete URL in the packet.

If NetCache receives this attribute from the RADIUS server, NetCache rewrites the URL to the URL that was sent. If the RADIUS server does not send this attribute, NetCache does nothing.