The password settings. If defined, password change is enabled over the RADIUS interface.

Password Settings

If enabled, password change is enabled over the RADIUS interface (requires password settings).

false

The port to listen on for the RADIUS service. Typically 1812 or 1645 (older systems) is used.

The IP of the interface the Radius server should listen on. This property is optional. If not present, the Radius service listens on all local interfaces.

192.168.1.13

127.0.0.1

localhost

If enabled, all clients must include a valid Message-Authenticator attribute in their requests, otherwise the messages will be discarded.

Note: even when disabled, received requests containing a Message-Authenticator will always be validated. Also, responses from this server will always include the Message-Authenticator attribute.

Warning: when disabled, this server is vulnerable to the BlastRADIUS attack.

true

The shared secret for the Radius service. The shared secret is used to protect sensitive information being sent from the Radius client to the Radius server. Since charsets on the server and the client may differ, use only ASCII characters (and choose a longer secret).

secret4th1ss3rv3r

s843bdfl03h4

wonttellu

The authenticator to be used by the Radius service. Make sure that the authentication scheme provided by the authenticator can be used via RADIUS. Client certificate authentication, for example, is usually not done via RADIUS. Common examples are password-, token-, and challenge-response-authentication.

Accepting Authenticator Active Directory Connector Airlock 2FA Authenticator Certificate Authenticator Certificate Token Authenticator Configuration-based Authenticator Credential-based Authenticator Selector Denying Authenticator Dummy Matrix Authenticator Dummy Polling Authenticator Dummy Two Step Authenticator Email Otp Authenticator Fallback Authenticator LDAP Connector LDAP Password Authenticator Lookup and Accept Authenticator MTAN/SMS Authenticator Main Authenticator Matrixcard Authenticator (TAN Challenge) Meta Authenticator NextGenPSD2 Certificate Authenticator OATH OTP Authenticator OAuth 2.0 Access Token Authenticator Password Authenticator RADIUS Authenticator SSO Credential Authenticator STET PSD2 Authenticator Selection Authenticator Static Authenticator Token Authenticator User-based Authenticator Selector

Configures the behavior of temporary user locking. Notice that responses are not delayed like in the login app not to trigger UDP retransmissions but any further request falling into the temporary lock timeout will be refused immediately with a special message.
If enabling the Temporary Locking settings, either a linear or an exponential factor must be provided or it will have no effect at all. Additionally, a user persister must be specified which must provide the number of failed logins and the last login attempt.

Temporary Locking Settings

The user persister used to calculate the temporary locking and to read out roles after a mandatory password change.

Active Directory Connector Cipher User Persister Combining Extended User Persister Combining User Persister Database User Persister Dummy Extended User Persister LDAP Connector LDAP User Persister Property User Persister

Check user authorizations, i.e. check if the user may access the requested service or not. If not configured, no authorization checks are performed.

Radius Authorization

The charset to be used to decode the password. Leave empty to use the JVM default charset.

UTF-8, ISO-8859-1

Certain authenticators support asynchronous authentication requests. That is, instead of a final result like accept or reject, an 'authentication pending' result is returned and the caller (in this case the radius service) must call the authenticator repeatedly to get a final result.

If this flag is enabled, the radius service performs the polling and blocks the response until a final result is available. If the flag is disabled, a response is immediately returned to the radius client, asking for a fake challenge (see property 'asynchronousReplyMessage'). When the challenge is returned (content is ignored), the authenticator is queried again and so on.

Note: If the radius service is blocking, the UDP timeout on the client side must be configured to be at least as long as the authenticator timeout.

true

If "Blocking If Asynchronous" is TRUE, how long should the radius service pause between polling the authenticator for a new status.

5000

If "Blocking If Asynchronous" is TRUE, how long should the radius services keep polling the authenticator before returning a failure.

60

If Airlock 2FA is used and "Blocking If Asynchronous" is enabled, fall back to Passcode after "Authenticator Polling Timeout [s]". Otherwise, the authentication is cancelled after the timeout.

true

If this attribute is set, the RADIUS server includes the plain password credential in an attribute in the RADIUS Access-Accept response when authentication succeeded.
The corresponding RADIUS attribute is used to transport the password to the RADIUS client. (The "Class" attribute has id 25, the "Filter-Id" attribute has id 11). Leave this property empty (or do not define the property) to turn this feature off.

CAUTION: If the feature is used, the password is sent in plaintext to the RADIUS client. This may be a security risk depending on the setup.

Class, Filter-Id

Use this property to enable returning of user roles with ACCEPT messages. This enables the Radius client to enforce authorization decisions made by Airlock IAM. If the property is undefined, no roles are returned.

Fortinet Roles Configuration RADIUS Roles As Reply-Message

If enabled, all RADIUS requests are logged together with the client IP, NAS-Identifier and username. The log is written with INFO level.

false

Determines the maximum number of open authentication sessions that are kept in the Radius server.

This value should be increased in high-traffic situations if authentication sessions are lost.

4096

Determines the maximum number of handled packet that are kept in the Radius server in order to detect retransmissions of packets.

This value should be increased in high-traffic situations when retransmitted packets are not detected and requests are therefore answered twice.

1024

Determines the maximum number of milliseconds between two identical looking requests such that they are still considered to be the same request (retransmission).

This value should be increased when a Radius client sends retransmissions after more than the indicated time. The value should be lowered if Radius requests are ignored because identical requests are sent within the indicated amount of milliseconds.

30000

Determines the maximum size of a received UDP packet in bytes.

This value should be increased if you experience problems because receiving only parts extraodinaryly long Radius packets.

8192

Specifies if the RSA/ACE compatibility mode should be used or not. If set to "TRUE", this server behaves like a RSA/ACE service would (important for some clients to distinguish next-token-mode from new-pin-mode).
When this mode is enabled, only authenticators that return ACE-like responses can be used. It can - for example - be used in combination with challenge-response authenticators.

false

Allows definition of a static test user for external monitoring of the Radius service. All login attempts with the static test user are rejected immediately without generating logfile entries. Even if the log level is set to DEBUG and option "logRadiusRequests" is enabled, requests with the static test user will not be logged.

Note: The static test user name must not coincide with an existing user name. Otherwise, the corresponding user will not be able to log in.

_RejectedUser

Specifies the reply message sent with an Access-Accept response.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Accept responses.

Login successful.

Authentication successful

Access granted

Specifies the reply message sent with an Access-Accept response after the password has been changed successfully.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, property "Access Accept Reply Message" will be included in Access-Accept responses.

Login and password change successful.

Authentication after password change successful

Access after password change granted

Specifies the reply message sent with an Access-Denied response.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Denied responses.

Login failed.

Authentication failed

Access denied

Specifies the reply message sent with an Access-Denied response because the user account is locked.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, the general access denied message (see separate property) is used.

Your user account is locked.

Account locked.

Your account has been locked for security reasons. Please contact our hotline.

Specifies the reply message sent with an Access-Denied response because the user account is temporarily locked. This only happens if Temporary Locking settings and the user persister are configured.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, the general access denied message (see separate property) is used.

Your user account has been locked temporarily. Please try again in a few minutes.

Account temporarily locked; please try again in a few minutes.

Specifies the reply message sent with an Access-Denied response because the user is not authorized (not enough rights).
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in the responses.

Access denied. Not enough access rights.

Not authorized.

Not enough rights

Specifies the reply message sent with an Access-Challenge response when in next-token mode.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Challenge responses.

Please wait for the NEXT token and enter it.

Enter next token

Please wait for next token and enter it

Specifies the reply message sent with an Access-Challenge response when in new-pin mode.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Challenge responses.

Please choose a new PIN.

Set new PIN

Please set a new PIN

Specifies the reply message sent with an Access-Challenge response when in pin-accepted state.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Challenge responses.

PIN accepted. Please wait for the NEXT token and enter it.

PIN Accepted. Enter next token

PIN changed. Please wait for next token and enter it

Specifies the reply message sent with an Access-Challenge response when a token is required. Use the variable ${LAST_USED_TOKEN} to include the last used token (may be an empty string!).
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Challenge responses.

Please enter next token.

Please enter next token. Last used token: ${LAST_USED_TOKEN}

Enter token

Specifies the reply message sent with an Access-Denied response when a required credential is not assigned to the user. If not set, no reply message will be included in the Access-Denied response.

No authentication token has been assigned to your account.

No token has been assigned to your account. Please contact the hotline.

Specifies the reply message sent with an Access-Challenge response when an index challenge is sent. This is the case when the underlying authenticator asks for a specific token and references it by an index. Use the variable ${INDEX} to include the index number in the message.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Challenge responses.

Please enter token at position ${INDEX}.

Please enter token at position ${INDEX}

Enter TAN at index ${INDEX}

Specifies the reply message sent with an Access-Challenge response when a matrix challenge is sent. This is the case when the underlying authenticator asks for a specific token and references it by one or more coordinate pairs. Use the variable ${CHALLENGE_COORDINATES} to include the coordinate pair(s) in the message.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Challenge responses.

Please enter token(s) ${CHALLENGE_COORDINATES}.

Please enter tokens ${CHALLENGE_COORDINATES}

Specifies the reply message sent with an Access-Challenge response when asking to set a new password.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Challenge responses.

Please choose a new password.

Set a new password:

Your password has expired, please choose a new password:

Specifies the reply message sent with an Access-Challenge response when asking to retype (confirm) the new password.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Challenge responses.

Please enter the new password again for confirmation.

Re-type the new password:

Please re-type the new password to confirm it:

Specifies the reply message sent with an Access-Denied response when the new password and its confirmation do not match.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Denied responses.

The passwords do not match. Please login again.

Passwords do not match. Login again.

The new password did not match its confirmation. Please login again.

Specifies the reply message sent with an Access-Denied response when the new password could not be accepted because of password policy violations.
Some RADIUS clients (such as keyboard-interactive authentication) may display this to the user. Other clients may make their behavior dependent on this message.

If not set, no reply message will be included in Access-Denied responses.

The new password has not been accepted because it violates the password policy.

Password not accepted.

The new password could not be accepted because it does not meet the requirements for new passwords.

If property "Blocking If Asynchronous" is FALSE, the service forwards 'authentication pending' results directly to the radius client in form of a challenge response. This is the message that is displayed to the user in that case. The actual reply to the challenge is ignored and the state of the authentication is checked again.

Please proceed authentication on your authentication device and press the login button when finished.

Please proceed authentication on the mobile phone and press the login button when finished.

Username transformers may transform the name received in a Radius request into the single unique user ID required for the authentication process.
The transformation of a username takes place before the authenticator reads the user from persistency layer. Transfomers can be chained, i.e. a first transformer could normalize the original name, after which the next transformer looks up the normalized name in a database for eventual transformation matches.
In addition to the above description of chaining, a transformer can also signal that it already found the final user ID and that the transformation must stop here.
For further details please refer to the documentation of the username transformer plugins.

Airlock 2FA Username Transformer Context Data Username Transformer Identity Username Transformer Lowercase Transformer Primary Key Lookup Regex Username Transformer Template-based Username Transformer Token Data Username Transformer Uppercase Transformer

Message displayed when the user is required to select a token from the given list.

Please choose:

Please choose:

Pass on the password to the authenticator as if it is a token code.

false

The accept modifiers may modify the final RADIUS accept packet before it is sent to the client.

Add Authentee Attribute