RADIUS Provider

You can configure a Radius provider for applications that don't support any other protocols or that require Radius.

info

This provider requires the deployment of the RADIUS outpost

Currently, only authentication requests are supported.

Authentication flow

Authentication requests against the Radius Server use a flow in the background. This allows you to use the same flows, stages, and policies as you do for web-based logins.

The following stages are supported:

• Identification

• Password

• Authenticator validation

  Note: Authenticator validation currently only supports DUO, TOTP, and static authenticators.

  For code-based authenticators, the code must be given as part of the bind password, separated by a semicolon. For example for the password example-password and the MFA token 123456, the input must be example-password;123456.

  SMS-based authenticators are not supported because they require a code to be sent from authentik, which is not possible during the bind.

• User Logout

• User Login

• Deny

RADIUS attributes

Starting with authentik 2024.8, you can create RADIUS provider property mappings, which make it possible to add custom attributes to the RADIUS response packets.

For example, to add the Cisco AV-Pair attribute, this snippet can be used:

define_attribute(
    vendor_code=9,
    vendor_name="Cisco",
    attribute_name="AV-Pair",
    attribute_code=1,
    attribute_type="string",
)
packet["Cisco-AV-Pair"] = "shell:priv-lvl=15"
return packet

After creation, make sure to select the RADIUS property mapping in the RADIUS provider.

Limitations

The RADIUS provider only supports the PAP (Password Authentication Protocol) protocol:

	Clear-text	NT hash	MD5 hash	Salted MD5 hash	SHA1 hash	Salted SHA1 hash	Unix Crypt
PAP
CHAP
Digest
MS-CHAP
PEAP
EAP-MSCHAPv2
Cisco LEAP
EAP-GTC
EAP-MD5
EAP-PWD