In this example, I will share how to authenticate SIP REGISTER and SIP INVITE against a database containing username, password and IP address. I have kamailio configured to use auth_db, usrloc, ipops (for IP restriction).
Here are snippets from the main config script, kamailio.cfg:
...
modparam("auth_db|usrloc", "db_url", DB_URL)
modparam("auth_db", "use_domain", 1)
modparam("auth_db", "calculate_ha1", 1)
modparam("auth_db", "user_column", "extension")
modparam("auth_db", "domain_column", "domain_name")
modparam("auth_db", "password_column", "password")
modparam("auth_db", "load_credentials", "$var(ip)=ip_address")
...
if (is_method("REGISTER")) {
# auth user/pass
if(!www_authenticate("$fd", "user_extension")) {
www_challenge("$fd", "1");
}
# apply IP auth
if (ip_type("$var(ip)") && !is_in_subnet("$si", "$var(ip)")) {
sl_send_reply( "403", "IP forbidden" );
exit;
}
if (!save("sip_registration")) {
sl_reply_error();
}
exit;
}
...
if (is_method("INVITE")) {
if (!proxy_authenticate("$fd", "user_extension")) {
proxy_challenge("$fd", "1");
exit;
}
if (ip_type("$var(ip)") && !is_in_subnet("$si", "$var(ip)")) {
sl_send_reply( "403", "IP forbidden" );
exit;
}
# INVITE authenticated at this point,
# continue processing packet in next lines
#
# ...
}
...
Here is my database schema for postgresql:
--
-- CREATE THE AUTO-INCREMENT SEQUENCE FOR TABLE
--
DROP SEQUENCE IF EXISTS public.user_extension_id CASCADE;
CREATE SEQUENCE public.user_extension_id
INCREMENT BY 1
MINVALUE 1
MAXVALUE 9223372036854775807
START WITH 1
CACHE 1
NO CYCLE
OWNED BY NONE;
ALTER SEQUENCE public.user_extension_id OWNER TO kamailio;
--
-- CREATE THE TABLE
--
DROP TABLE IF EXISTS public.user_extension CASCADE;
CREATE TABLE public.user_extension(
user_extension_id integer NOT NULL DEFAULT nextval('user_extension_id'::regclass),
domain_name VARCHAR(64) DEFAULT '' NOT NULL,
extension text,
password text,
ip_address text,
CONSTRAINT user_extension_pkey PRIMARY KEY (user_extension_id),
CONSTRAINT user_extension_key UNIQUE (domain_name,extension)
);
ALTER TABLE public.user_extension OWNER TO kamailio;
--
-- INSERT EXAMPLE USER
--
INSERT INTO user_extension (domain_name, extension, password, ip_address) VALUES ('sip.domain', '1000', '1000TEST1000', '192.168.0.11');
Assuming you have everything else setup correctly in Kamailio, you should be able to register to the proxy using username '1000', password '1000TEST1000' and from only the IP address '192.168.0.11'
*Please note you can use CIDR notation to allow whole subnets like 192.168.0.0/24
