AAA RADIUS Configuration

Configure the RADIUS servers used for authentication

Up to three RADIUS servers can be configured, each with a unique priority from 1 to 3. On login the servers are contacted in priority order. The role of an authenticated user is derived from the attributes returned by the server through the priv_lvl_ref_table rules; if no rule matches, fallback_role is used, and with fallback_role set to none the login is refused. Whether RADIUS is used at all, and when, is set on the AAA Configuration page.

API

• Data (RADIUS_SERVER object):

  {
      "id": 3,
      "secret": "testing123",
      "priority": 2,
      "hostname": "172.17.0.2",
      "port": 1812,
      "timeout": 3,
      "fallback_role": "user",
      "priv_lvl_ref_table": [
          {
              "attribute_name": "Callback-Number",
              "attribute_data_type": "int",
              "comparison_value": "56",
              "comparison_operator": "<=",
              "role": "admin"
          },
          {
              "attribute_name": "Callback-Number",
              "attribute_data_type": "str",
              "comparison_value": "^qwerty56$",
              "comparison_operator": "=~",
              "role": "viewer"
          }
      ]
  }

  • id - unsigned integer assigned by the device (read-only)
  • secret - shared secret, 1 to 65 alphanumeric and special characters
  • priority - 1 to 3, unique among the configured servers
  • hostname - hostname, IPv4 or IPv6 address
  • port - 1 to 65535
  • timeout - seconds to wait for the server, 1 to 5
  • fallback_role - role used when no rule matches: none, viewer, user (equal to operator) or admin; defaults to none
  • priv_lvl_ref_table - list of rules mapping RADIUS attributes to roles; may be empty
    • attribute_name - name of the RADIUS attribute to inspect
    • attribute_data_type - str or int
    • comparison_value - value to compare with, always a string
    • comparison_operator:
      • <, <=, >, >= - integers only
      • =~ - regular expression match, strings only
      • ==, != - any type
    • role - viewer, user (equal to operator) or admin

  A field that violates its constraint is rejected with 422 (see Responses). An operator that does not fit the attribute type is reported as comparison_operator is not valid for an attribute of an integer type.

• Get all RADIUS servers

  • Path: /api/aaa/radius
  • Method: GET
  • Minimum user role: admin
  • Response on success (200 OK): array of RADIUS_SERVER objects in data

• Get a RADIUS server

  • Path: /api/aaa/radius/{id}
  • Method: GET
  • Minimum user role: admin
  • Response on success (200 OK): RADIUS_SERVER object in data
  • Response on failure (404 Not Found): no server with this id

• Add a RADIUS server

  • Path: /api/aaa/radius
  • Method: POST
  • Minimum user role: admin
  • Request body: RADIUS_SERVER object without id; secret, priority, hostname, port and timeout are mandatory, fallback_role and priv_lvl_ref_table may be omitted
  • Response on success (200 OK): message Successfully added the radius_server., the created object in data
  • Response on failure: 412 Could not add RADIUS server: priority <n> already exists, 422 on a constraint violation

• Update a RADIUS server

  • Path: /api/aaa/radius/{id}
  • Method: PUT
  • Minimum user role: admin
  • Request body: RADIUS_SERVER object; fields that are omitted keep their current value
  • Response on success (200 OK): message Successfully updated the radius_server., the updated object in data
  • Response on failure: 404 if no such server, 412 if the new priority is already used by another server, 422 on a constraint violation

• Update all RADIUS servers

  • Path: /api/aaa/radius
  • Method: PUT
  • Minimum user role: admin
  • Request body: array of RADIUS_SERVER objects with id set. The array must contain every configured server exactly once; servers cannot be added or removed with this call.
  • Response on success (200 OK): the stored array in data
  • Response on failure (400 Bad Request): Error, not all the entries are present in the request. or Error, not all the entries have unique priorities.; 422 on a constraint violation

• Delete a RADIUS server

  • Path: /api/aaa/radius/{id}
  • Method: DELETE
  • Minimum user role: admin
  • Response on success (200 OK): message Successfully deleted the radius_server., the deleted object in data
  • Response on failure (404 Not Found): no server with this id

• Delete all RADIUS servers

  • Path: /api/aaa/radius
  • Method: DELETE
  • Minimum user role: admin
  • Response on success (200 OK): message Successfully removed all RADIUS servers; succeeds also when the list is already empty

Back to Index