RADIUS server authentication field descriptions

Last Updated : Jan 12, 2023 |

Name

Description

Enabled

A check box indicating whether the RADIUS user accounts must be authenticated using Authentication, Authorization, and Accounting (AAA).

If selected, RADIUS user accounts are authenticated by the server selected from the Radius Server option.

If cleared, RADIUS user accounts are not authenticated.

RADIUS Server

Select the RADIUS server being used for AAA.

RADIUS Authentication Protocol

A drop-down menu containing all supported RADIUS authentication methods. This menu is used instead of the authentication protocol of the configured RADIUS profile. The currently supported methods are:

  • Password Authentication Protocol (PAP): The password is transmitted in plain text to the RADIUS server.

  • RFC 5090/Digest: The password uses a client and server one time to generate an MD5 authentication token for use with an RFC 5090–compliant RADIUS server.

  • Challenge-Handshake Authentication Protocol (CHAP): The password is salted with a rolling ID, hashed, and transmitted to the RADIUS server.

RADIUS Realm

The realm to use when generating the Digest authentication token. Use the same value in this field as the value configured on the RADIUS server.

Use RADIUS as Fall-through Authenticator

Select this option to enable a back end authentication server to handle any authentication requests for users that are not defined in the EMS user list.

This is done by sending an Access-Request packet to the RADIUS server, which looks for a specific attribute in the Access-Accept response as defined in the Role Name Attribute option. If the attribute is present, it must match a predefined role in the EMS (that is, System Administrator, Security Administrator, and so on) or the authorization fails and the user login request is rejected. If the attribute is not present in the request, the authorization fails and the user login request is rejected.

Disabling fall-through authentication will log out all users logged in using that functionality. A new option has been added to the user's list to forcibly log out any logged in user. This option is only available to users with System Administrator level privileges.

Note:

When using both RADIUS authentication and X.509 certificate authentication at the same time, X.509 certificate support will only work if the X.509 Authentication Mode option is set to Require X.509 Certificate and Password. Any other option will fail in the authorization stage and reject the login request.

Role Name Attribute

Enter a name you want to use as the role name attribute. By default, Role Name Attribute is set to Avaya-SBCE-Role-Name.

If you are using attributes that are defined in the standard RADIUS dictionary, you can use the standard dictionary and a custom dictionary is not required.

However, if you are using the default attribute name Avaya-SBCE-Role-Name, or are using a vendor-specific attribute as the role attribute name, you must create a custom dictionary definition. A custom dictionary is required to handle the attribute the Avaya SBC requires for authorization. A sample dictionary is provided below, which can be modified with any values if necessary. If a different RADIUS attribute is desired, then any attribute can be used including both default values and custom values.

Note:

There might be scenarios when a custom dictionary is required to define a new attribute that Avaya SBC administration can recognize, or to handle conflicts if a RADIUS server is already using an existing Avaya dictionary. In this scenario, Avaya SBC administration will read from a file located at /usr/local/ipcs/etc/gui-radius-dictionary, if it exists. It is important to note that defining this file will prevent Avaya SBC administration from reading the default dictionary and instead use the contents of the file as the new dictionary.

###########################################################
# WARNING: This dictionary file is intended to be a sample and 
# is intended to illustrate how to define attributes for use with
# the Avaya SBCE SSO fall-through authentication functionality.  
# The identifiers in this file have not been officially allocated 
# and may need modification to interop with other vendor specific 
# attributes from Avaya or other vendors.
####################################################################
VENDOR Avaya-SBCE 6889
BEGIN-VENDOR Avaya-SBCE
 
ATTRIBUTE   Avaya-SBCE-Role-Name    1       string
 
END-VENDOR Avaya-SBCE