Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the shared secret in RADIUS and TACACS+?
Short answer
The shared secret is the secret text that the client (TR7) and the authentication server have set to the same value in advance. In RADIUS, it is used to verify that the server responses really come from that server and to hide the User-Password field in the request (RFC 2865 §3); in TACACS+, the entire packet body is hidden with this value; RFC 8907 calls this method obfuscation, not encryption (RFC 8907). The value must be exactly the same on both sides; if it differs, the server rejects the request or leaves it unanswered, TR7, for its part, cannot verify the response, and the login fails. In TR7, the shared secret is entered in three places: RADIUS Shared Secret in the AGS Authentication Servers form, Secret Token on the RADIUS Settings screen and TACACS Secret on the TACACS Settings screen. The RADIUS Settings and TACACS Settings view screens do not list the secret; in the AGS preview, the value appears as ********.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Servers | With Protocol = RADIUS, RADIUS Shared Secret (required) | The secret that AGS shares with the RADIUS server |
| Settings → User Management → RADIUS Settings | Secret Token | The secret used when management users are verified with RADIUS |
| Settings → User Management → TACACS Settings | TACACS Secret | The secret used when management users are verified with TACACS+ and in accounting records |
| RADIUS Settings and TACACS Settings screens | Check Radius Connection, Check TACACS Connection | Trying the connection with the entered server and secret |
The Role of the Secret in RADIUS and TACACS+
| RADIUS | TACACS+ | |
|---|---|---|
| What is protected | The User-Password field is hidden; it is verified that the response comes from the server | The entire packet body is hidden (obfuscation) |
| The rest of the packet | The other attributes travel in the clear | Only the header travels in the clear |
| TR7 field | RADIUS Shared Secret, Secret token | TACACS secret |
Common Misconceptions
- "The shared secret is the user password." The shared secret establishes the trust between TR7 and the server; it has nothing to do with the users' passwords and is the same for every user.
- "A simple shared secret is enough." Hiding the password in RADIUS and hiding the packet body in TACACS+ rely on this value; a long and random value is selected.
- "Changing the secret only on TR7 is enough." The value is also changed on the server (e.g. in the RADIUS client record in NPS) at the same time; after it is changed, it is tried with Check Radius Connection or Check TACACS Connection.
How it is done in the documentation
