Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a RADIUS attribute?
Short answer
A RADIUS attribute is a type-length-value (TLV) field carried in the RADIUS request and response; each attribute has a standard number and name (RFC 2865 §5). The client sends attributes in the Access-Request that identify the user and the client itself (e.g. User-Name, User-Password, NAS-Identifier); the server makes its decision based on these and its own policies, and can return information about the user (e.g. Class, Session-Timeout, Reply-Message) as attributes in the Access-Accept response. In TR7 AGS, an Authentication Provider of the RADIUS type sends the username and password with the expressions in the RADIUS Username and RADIUS Password fields; while the RADIUS Extra Attributes switch is in the Automatic position, no additional attributes are added to the request, and when it is moved to the Choose position, additional attributes are added with the Attribute name and Attribute value table (e.g. NAS-Identifier); a Smart Variable can be used in the values.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers (RADIUS) | RADIUS Extra Attributes: Automatic / Choose → Attribute name, Attribute value | Adding additional attributes to the request (e.g. NAS-Identifier so that the server policy recognizes the client) |
| Same form | RADIUS Username, RADIUS Password (their defaults are %AGS_USER_INPUT(username) and %AGS_USER_INPUT(password)), RADIUS Authentication Type (PAP / CHAP) | The content of the username and password attributes in the request and the way the password is sent |
| Same form | Custom User Attribute Mapping | There is no automatic mapping in the RADIUS type; the required user information is mapped manually |
| Settings → User Management → RADIUS Settings | Host, Port, Secret Token | At management login, TR7 sends the User-Name and User-Password attributes in the Access-Request; there is no additional attribute setting |
Commonly Used Attributes
| No | Attribute | Direction | Meaning |
|---|---|---|---|
| 1 | User-Name | Request | The username |
| 2 | User-Password | Request | The password, hidden with the shared secret in PAP |
| 3 | CHAP-Password | Request | The response sent in place of the password in CHAP |
| 4 | NAS-IP-Address | Request | The IP address of the client |
| 32 | NAS-Identifier | Request | The name of the client; for telling the client apart in server policies |
| 18 | Reply-Message | Response | The message to be shown to the user |
| 25 | Class | Response | The class assigned by the server (e.g. for carrying group information) |
| 27 | Session-Timeout | Response | The maximum duration of the session (seconds) |
Common Misconceptions
- "Attributes come back only from the server." The client also sends attributes in the request; the network policies of servers such as NPS can match on request attributes such as NAS-Identifier.
- "Adding additional attributes is mandatory." RADIUS Extra Attributes can be left in the Automatic position; an additional attribute is added only if the server policy requires it.
- "The attributes in the response are written to the user fields on their own." There is no automatic mapping in the RADIUS type; the required information is mapped with Custom User Attribute Mapping.
How it is done in the documentation
