How to create and return custom standard radius attribute
Originally Published: 2019-05-06
Article Number
Applies To
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Issue
Resolution
1. Open security console using superadmin account
2. Click on Radius -> Radius user attribute definition -> Add new
3. Now the user attribute should be defined. For example please see the below:
Notes:
- The example above is using non-mapped Identity source attribute. If a mapped attribute is needed, A mapped attribute have to be created before as per this article Adding a new user attribute in a user profile in RSA Authentication Manager 8.x
- For the attribute number, The number chosen should be a number that is not used in the default radius dictionary (radius.dct) on the AM. For this, number 120 can be used as it is not used.
- Make sure of the attribute name, this have to be written in radius dictionary file (radius.dct) exactly as defined in step 2 (case sensitive). For example, the custom attribute that is created here is Access
- Choose the attribute return type as desired. In the above example a String is used
Second Step: Define the attribute in the operation console radius dictionary (radius.dct) as below:
1. Open Operation console
2. Click on Deployment configuration -> Radius Servers
3. Choose the server that the Radius client you have authenticates on.
Note: If the Radius client authenticates to the Primary and Replica, the below steps (5 to 7) will need to be done on all AM servers (Primary and Replicas) as any change in radius configuration files is not replicated
4. Click on the black arrow next to the Primary AM name then choose Manage server files
5. Click on Dictionary Files tab, then choose page 4 and edit radius.dct file
6. Add the following attribute line definition as per screenshot.
ATTRIBUTE <Attribute-Name-defined> <Attribute-number-defined> string r
For example:
ATTRIBUTE Access 120 string r
7. Click on Save & Restart Radius server for the effects to take place.
Third Step: Assign Radius attribute to the user
1. Open security console using superadmin account
2. Click on Radius -> Radius Profile -> Add new
3. Return the attribute just created and add the value you want to return. For example: allow
4. Click on Add
5. Save Profile
6. Assign profile to users
This is all the configuration from the Authentication Manager side to return the attribute. However, make sure to configure the attribute on the client side with the help of client Admin. So that both Servers have the attribute defined on
