<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<tt>Hi Pat,<br>
<br>
I see 2 scenarios here (in both cases, the calledID and the auth
user are completely different, they cannot be calculated one from
the other):<br>
<br>
* if the caller sends in FROM the auth username and in PAI/RPID
the CLI, you should be fine.<br>
<br>
* if the caller sends in FROM the CLI, then it should send in the
auth answer the (as "username" attribute) the right auth username.
The authentication should be successful, but you should check if
the advertised CLI (in FROM) is allowed to use authentication
username<br>
<br>
So, bottom line (I think you are on the second scenario), you have
to keep the db_check_from(), re-configure the URI module to
perform the check against a predefined set of mappings (auth
username as per subscriber and SIP username as per FROM hdr) vi DB
table "uri" - see the "db_table" and "use_uri_table" parameters:<br>
<a class="moz-txt-link-freetext" href="http://www.opensips.org/html/docs/modules/2.3.x/uri.html#use-uri-table">http://www.opensips.org/html/docs/modules/2.3.x/uri.html#use-uri-table</a><br>
<br>
Or using avp_db_query() you can make your one SQL query for
checking (via custom table) if the auth username is allowed with a
certain CLI (FROM username)<br>
<br>
Best regards,<br>
</tt>
<pre class="moz-signature" cols="72">Bogdan-Andrei Iancu
OpenSIPS Founder and Developer
<a class="moz-txt-link-freetext" href="http://www.opensips-solutions.com">http://www.opensips-solutions.com</a>
OpenSIPS Bootcamp 2017, Houston, US
<a class="moz-txt-link-freetext" href="http://opensips.org/training/OpenSIPS_Bootcamp_2017.html">http://opensips.org/training/OpenSIPS_Bootcamp_2017.html</a>
</pre>
<div class="moz-cite-prefix">On 07/25/2017 03:32 AM, Pat Burke
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:8d4725b82a890a5fc9af8438f2498bdb@voxtelesys.com">
<title></title>
<div class="iw_mail" dir="ltr">Hello,<br>
<br>
As a SIP Provider, we implementing the ability to provide SIP
trunks to customers with a PBX or Dialer that require
Registration. With this in mind,<br>
the customer wants to be able to set the CallerID on at least on
the basis of the devices connected tho them, but potentially on
a per call basis.<br>
<br>
For the challenge-response to the non-Register methods, we have
implemented the script as follows (seems to be a very standard
way). My question is<br>
for the case of the CallerID not being the same as the
username/authorization name, how do we do this? Because the
"FROM" user is different from the<br>
authorized user, the db_check_from fails. I don't believe all
phone systems support P-Asserted-ID, so we can't really go that
route. So can we just remove<br>
the "db_check_from"? What risk does that expose us to?<br>
<br>
<pre style="background-color:#ffffff;color:#000000;font-family:'DejaVu Sans Mono';font-size:11.3pt;">if ( !(is_method("REGISTER")) ) {
if (is_from_local("$var(reg_domain_attr)")) { # from Registered device
$avp(callee_number_type) := "Registered";
# authenticate if from local subscriber
# authenticate all initial non-REGISTER request that pretend to be
# generated by local subscriber (domain from FROM URI is local)
if (!proxy_authorize("", "subscriber")) {
proxy_challenge("", "0");
exit;
}
if (!db_check_from()) {
sl_send_reply("403","Forbidden auth ID");
exit;
}
consume_credentials();
# caller authenticated
}
}
</pre>
<span data-mce-style="color: #808080; font-family:
arial,helvetica,sans-serif; font-size: 11pt;" style="color:
rgb(128, 128, 128); font-size: 11pt;">Regards,</span>
<div class="signature">
<div style="font-family: arial, helvetica, sans-serif;
font-size: 16px;">
<span data-mce-style="color: #808080; font-family:
arial,helvetica,sans-serif; font-size: 11pt;"
style="color: rgb(128, 128, 128); font-size: 11pt;"><strong>Pat
Burke</strong></span><br>
<br>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a>
<a class="moz-txt-link-freetext" href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a>
</pre>
</blockquote>
<br>
</body>
</html>