What is RADIUS; where is it used in TR7?

Short answer

RADIUS (Remote Authentication Dial-In User Service) is the protocol in which a client device asks a central server about a username and password with an Access-Request, and the server responds with Access-Accept or Access-Reject; the standard UDP port for authentication is 1812 (RFC 2865). Microsoft NPS, FreeRADIUS and MFA servers that speak RADIUS take on this role; TR7 is defined as a client on the RADIUS server, and the two sides use the same shared secret. In TR7, it is used in two places: in AGS, application users are verified with an Authentication Provider of the RADIUS type against the RADIUS server on the Authentication Servers screen; management users whose Authorization Source value is Radius are verified against the server on the RADIUS Settings screen.

Where It Is Used in TR7

Where	Field / label	What for
AGS → Authentication → Authentication Providers	Provider Type = RADIUS; RADIUS Authentication Type (PAP / CHAP), RADIUS Extra Attributes	Verifying the users who enter the application behind the AGS-enabled vService on the RADIUS server
AGS → Authentication → Authentication Servers	Protocol = RADIUS; RADIUS Shared Secret, Server Hosts	The address, port and shared secret of the RADIUS servers
Settings → User Management → RADIUS Settings	Host, Port, Secret Token	Login of management users to the TR7 interface with RADIUS
Settings → User Management → Device Users	Authorization Source = Radius; the RADIUS source in the User Creation Source field	Which management user is verified on RADIUS; automatic creation of the user at the first RADIUS login

Common Misconceptions

• "RADIUS is only for old dial-up connections." Although its name comes from there, today it is an authentication protocol widely used in VPN, Wi-Fi and MFA products.
• "RADIUS encrypts the entire packet." RADIUS hides only the User-Password field with the shared secret; the other attributes of the packet travel in the clear (What is TACACS+; how does it differ from RADIUS?).
• "In AGS, a RADIUS server row is added with port 1812 on its own." In Authentication Servers, a new Server Hosts row is added with port 389 regardless of the Protocol; the port of the RADIUS server (usually 1812) is written in the row manually. The Port field in RADIUS Settings, on the other hand, comes empty; the port the server uses is written in this field.

How it is done in the documentation

• RADIUS · What Is RADIUS?
• Authentication Servers · RADIUS
• RADIUS Settings · What Is RADIUS Settings?

Related questions

• What is the shared secret in RADIUS and TACACS+?
• What is a RADIUS attribute?
• What is TACACS+; how does it differ from RADIUS?