RADIUS > Attributes
Remote Authentication Dial-In User Service (RADIUS) attributes are used to define specific authentication, authorization, and accounting (AAA) elements in a user profile, which are stored on the RADIUS program.
RADIUS Internet Engineering Task Force (IETF) attributes are the original set of 255 standard attributes that are used to communicate AAA information between a client and a server. The IETF attributes are standard and the attribute data is predefined. All clients and servers that exchange AAA information using IETF attributes must agree on attribute data such as the exact meaning of the attributes and the general bounds of the values for each attribute.[1]
You can search for one or more attributes in this menu.
Useful User and Group Authentication Attributes
| attribute | Operator | Value | Description |
|---|---|---|---|
| PAP-Auth-Allow | := | 1 | When not using Phase 2 Authentication Using PAP, use this attribute to allow 2-Step PAP authentication for specific users or groups. |
| PAP-Auth-Deny | := | 1 | When using Phase 2 Authentication Using PAP, use this attribute to deny 2-Step PAP authentication for specific users or groups. |
| Login-Time | += | text | The Login-Time attribute defines the time span during which a user may login to the system and can deny the authentication on specified days/times. It also allows for automatic termination of wireless LAN connections if they are already established after the specified end time. However, adding this attribute later to a device already connected to the wireless LAN may not result in automatic disconnection.
Wireless equipment needs to support Session-Timeout attribute for automatic disconnection. You should define time strings using the "Day%H%M-Day%H%M" format. Days can be Mo, Tu, We, Th, Fr, Sa, or Su, with "Wk" for weekdays and "Any" for all days. [2] Multiple time strings may be a list of simple time strings separated by "|" For examples)
|
| User-Login-Time | := | text | It is similar to the Login-Time attribute. however, it is an exclusive attribute that does not affect users if they are part of a specific group with its own Login-Time attribute. This attribute applies only to users. |
| Group-Login-Time | := | text | It is also similar to the Login-Time attribute but acts as an exclusive attribute that takes precedence over Login-Time attributes for users who are part of a group, even if they have their own Login-Time attribute. However, if a user has a User-Login-Time attribute, Group-Login-Time will not be applied (User-Login-Time takes the highest priority). This attribute applies only to groups. |
| Calling-Station-Id | =~ | mac address1 | mac address2 ... | It is used to include the user's device MAC address for user identification during authentication. If this attribute is included, user authentication requires a match in Username, User-Password, and MAC address. You can use the "|" symbol to define multiple MAC addresses. When entering MAC addresses, use lowercase letters without separators.
For examples)
MAC addresses are in hexadecimal, and you should enter them in lowercase without any separators. When including multiple MAC addresses, be sure to separate them using "|" within a single Calling-Station-Id attribute. If multiple MAC addresses are defined, authentication will succeed if any one of them matches. |
| Nas-Identifier | =~ | ssid | You can specify the SSID when authenticating individual users and users included in a group. In other words, authentication will only proceed if the user connects through a specific SSID. To define multiple SSIDs, use "|". For examples)
|
| Expiration | := | datetime | This can be set in user or group attributes and refers to the authentication expiration time. When the time for this attribute expires, authentication for the user with this attribute or users belonging to groups that include this attribute will be denied.
The expiration time should be defined in the format "%b %d %Y %H:%M:%S %Z." To set the expiration time for individual users, specify "Expiration" in the detailed information of the RADIUS Users page, and then this attribute will be automatically added, so use that interface. |
Useful User and Group Reply Attributes
| attribute | Operator | Value | Description |
|---|---|---|---|
| Session-Timeout | := | 3600~86400(second) | It refers to the Session-Timeout of a user connected to the wireless LAN, and when this time elapses, a new wireless LAN encryption key is generated to maintain a secure wireless LAN connection. In a typical WPA-Enterprise environment through a wireless LAN authentication server, keys are generated securely to maintain an encrypted channel. However, to ensure an even more secure encrypted channel, you can use this attribute. |