Scenario: IP authentication with user name validation

About this scenario

The goals for this scenario are as follows:

Authenticate the user without prompting
Authorize the user by client IP address, the user associated with that IP address, and the requested URL

If a problem prevents the RADIUS or application server from obtaining a mapping of user to IP address, the RADIUS server can inform the NetCache appliance to request a user name and password from the client software.

In this scenario, the NetCache appliance is aware of the identity of the user who is making a request. For a deployment in which the NetCache appliance is unaware of users' identities, see Scenario: Using the IP authentication feature for access control by URL.

Example 1: Successful authentication and authentication without prompting

The following illustration shows authentication successfully accomplished based on the client IP address--that is, the user is not prompted for a user name and password. In this example, the user is authorized to view the requested stream.

The following table provides details about the preceding illustration.

Stage	Description
1	The user requests a stream.
2	The appliance sends the requested URL and the client IP address to the RADIUS server.
3	The RADIUS server sends the client IP address and requested URL to the application server.
4	The application server attempts to match the IP address that was passed to it to a user name in its database. If no match occurs, the application server informs the RADIUS server, which in turn informs the NetCache appliance that it must inform the client software to prompt for a user name and password.
5	If a match occurs, the application server sends the IP address, user name, and URL to its authorization component (represented by the billing service in this illustration).
6	The authorization component determines whether the user can be approved to watch the stream.
7	If the authorization component approves the user to watch the stream, the application server and RADIUS server inform the NetCache appliance. The appliance then serves the requested content. If the authorization component does not approve the user's request to watch the content, then the client is denied.

Planning for configuration

Configuration of the NetCache appliance and the RADIUS server involves the following.

Configuration requirements for the appliance

Configure the following on the Setup tab > Authentication > RADIUS page:

Basic RADIUS configuration on the appliance
Use the IP Authentication Protocol option and IP Authentication Password option (on the Extensions tab of the RADIUS page)

Configuration requirements for the RADIUS server

The RADIUS server developer must program the RADIUS server to

Use the password configured in the IP Authentication Password option on the appliance to connect to the appliance
Recognize the Auth-type value in Vendor-Netapp-2 and recognize that type as a 1 or 2
Send Vendor-Netapp-3 in Access:Reject packets

See Chapter 5, API--NetApp RADIUS extensions, for more details.