| Attributes |
AkaStalenessTimerDT |
-
cscfAkaStalenessTimer
=
1440
-
Maximum lifetime for AKA authentication. A zero value means that the timer never expires. This parameter is NOT access aware.
|
String0to65535DT
key
mandatory
noNotification
restricted |
-
cscfAuthentication
-
This is the key attribute of the CscfAuthenticationClass containing all the authentication parameters. One instance of the CscfAuthenticationClass with the key CscfAuthentication=default is created at startup. It is possible to create new instances. The default instance can not be deleted.
|
boolean |
-
cscfAuthenticationBlackListEnabled
=
false
-
This parameter is used to enable and disable the Blacklist function. Default is set to false, that means the function is not enabled.
|
AuthPolicyDT[7..] nonUnique ordered |
-
cscfAuthenticationPolicyEntry
=
Re-Registration:disabled,User Initiated De-Registration:disabled,INVITE:disabled,BYE:disabled,MESSAGE:disabled,SUBSCRIBE:disabled,NOTIFY:disabled
-
This attribute defines the authentication policy for a specific SIP method or registration condition. Multiple attributes of this type are allowed. The default values cannot be removed, but the policy part can be changed. This parameter is access aware.
This attribute value is in the form of: "method":"policy" or "registration_type":"policy"
method = string defining SIP method type such as INVITE
policy = enabled or disabled
registration_type = Re-Registration, User Initiated De-Registration
|
AuthProcedureDT |
-
cscfAuthenticationProcedure
=
digest
-
Used for authentication optimization, to avoid the second round trip of the challenge / response after the inital registration. This parameter only applies to Digest authentication.
This parameter is NOT access aware.
|
Integer1to65535DT |
-
cscfBlackListLoggingFrequency
=
1
-
This parameter defines the maximum number of blacklist time periods have to complete before log is issued. Default is set to 1. Unit: Number of blacklist time periods.
|
BlacklistMaxAuthAttemptsDT[0..1] |
-
cscfBlackListMaxAuthenticationAttempt
=
3
-
This parameter is used to configure the limit of the number of consecutive authentication attempts due to a failed verification of an authentication response. When max value is reached, the SIP client is blacklisted. All subsequent authentication attempts from this SIP client will be rejected by S-CSCF for the period of time specified in the CscfBlackListTimer parameter. This parameter is NOT access aware.
|
Integer0to65535DT[0..1] |
-
cscfBlackListTimer
=
300
-
This parameter is used to configure the period of time in seconds that the user's request will not be processed and rejected due to maximum number of failed authentications.
|
String0to01024DT[0..] nonUnique ordered |
-
cscfNBAAccessNetworkType
-
This parameter contains a list of access network types for which NASS bundled authentication is applicable. If the list is empty, the NBA function is disabled. Default is an empty list. This parameter is NOT access aware.
Format: P-Access-Network-Info header, Access network types
|
Integer0to65535DT |
-
cscfNbaChallengeAuthenticationNonceTimeLength
=
0
-
This parameter is used to configure the length of time in seconds that a nonce used in a NBA (NASS Bundled Authentication) Challenge Authentication response, is considered valid. A zero value means that the timer never expires. This parameter is NOT access aware.
Takes effect: ChangeTypeRuntimeType - Session / Registration
|
AuthPolicyEnabledDT |
-
cscfOverallAuthenticationPolicyEnabled
=
enabled
-
This attribute defines the overall authentication policy for the CSCF. If this is set to enabled, initially all initial registrations are always authenticated. The authentication of all other requests is based on the CscfAuthenticationPolicyEntries. This parameter is NOT access aware.
|
Integer1to65535DT[0..1] |
-
cscfSipDigestAuthenticationNonceReusabilityLimit
=
10
-
This parameter is used to configure the maximum number of times a generated nonce can be reused. This parameter is NOT access aware.
|
Integer0to65535DT[0..1] |
-
cscfSipDigestAuthenticationNonceTimeLength
=
900
-
This parameter is used to configure the length of time in seconds that a nonce used in a Digest Authentication response, is considered valid. This parameter is NOT access aware. A zero value means that the timer never expires.
|
boolean |
-
cscfSSOAuthenticationEnabled
=
false
-
If set to true, Single Sign-On authentication is enabled. This parameter is access aware.
Deprecated:
|
TrustedAsDT[0..] nonUnique ordered |
-
cscfTrustedASEntry
=
0.0.0.0
-
This parameter holds a list of trusted application servers. Each CscfTrustedASEntry forming the list contains an IPv4 or IPv6 address. This parameter is NOT access aware.
|
TrustedGwDT[0..] nonUnique ordered |
-
cscfTrustedGatewayEntry
=
0.0.0.0/32
-
This parameter holds a list of trusted SIP gateway nodes. Each CscfTrustedGatewayEntry forming the list contains an IPv4 or IPv6 address and the prefix length, separated by a slash sign "/". The prefix length is a number between 0 - 32 for IPv4 and between 0 - 128 for IPv6. This is the amount of bits of the IP address that are the subnet. The CSCF uses this list to authenticate SIP nodes that do not support digest authentication.
|
boolean |
-
scscfGibaAuthenticationEnabled
=
false
-
This parameter is used for enabling or disabling the GIBA (GPRS IMS Bundled Authentication) authentication in the CSCF node. This parameter is access aware. ScscfGibaAuthenticationEnabled cannot be enabled at the same time as ScscfSipDigestAuthenticationRealm is configured.
|
boolean |
-
scscfNbaAuthSchemeUnknownEnabled
=
false
-
If set to true, Line Profile is enabled. This parameter is not access aware.
|
boolean |
-
scscfNbaChallengeEnabled
=
false
-
This parameter is used to enable and disable the additional challenge for the NBA authentication. If enabled, a challenge is included as part of the NBA authentication for all REGISTER and possibly De-REGISTER, Re-REGISTER and INVITE requests.
|
HssBypassDT |
-
scscfReRegWithAuthBypass
=
NO_BYPASS
-
NO_BYPASS=CSCF performs normal reregistration handling with HSS inquiry.
BYPASS_ IF_FAILED= The reregister request is sent directly to S-CSCF when HSS inquiry fails due to HSS overloaded, no reply or request not sent due to throttling.
|
String0to01024DT[0..1] |
-
scscfSipDigestAuthenticationRealm
=
""
-
This parameter is used for indicating the Digest Authentication Realm for Digest users in the CSCF node.
This parameter contains a string to be displayed to users so they know which username and password to use.
This string contains at least the name of the host performing the authentication.
This parameter is also used for enabling or disabling Digest authentication for UEs not sending SIP Authorization header in 1st REGISTER, in the CSCF node.
The presence of a non-empty Digest Authentication Realm enables the feature.
Empty string means Digest authentication for UEs not sending SIP Authorization header in 1st REGISTER is disabled
This parameter MUST be configured with the same content as Digest-Realm is configured in HSS.
This parameter is access aware.
ScscfSipDigestAuthenticationRealm cannot be enabled at the same time as ScscfGibaAuthenticationEnabled.
Example: "Welcome to the ims.XYZ.net network, please insert your username and password"
|