6.3.1.15. RADIUS

The token type RADIUS forwards the authentication request to a RADIUS Server.

When forwarding the authentication request, you can change the username and check the PIN locally, so that only the remaining part of the password is forwarded (see Check the PIN locally).

Enroll a RADIUS token

Check the PIN locally

If checked, the PIN of the token will be checked on the local server. If the PIN matches only the remaining part of the issued password will be sent to the RADIUS server.

RADIUS Server configuration

The configuration of the RADIUS server to which the authentication request will be forwarded. The configuration can be defined in RADIUS server configuration

RADIUS User

RADIUS User is required. The RADIUS request is always sent for this user name, not for the user who is authenticating.

RADIUS Secret

The RADIUS secret for this RADIUS client. The WebUI does not show this field: the secret is part of the RADIUS server configuration. Only an API request that passes radius.server instead of a radius.identifier uses the parameter radius.secret.

Note

Using the RADIUS token you can design migration scenarios. When migrating from other (proprietary) OTP solutions, you can enroll a RADIUS token for the users. The RADIUS token points to the RADIUS server of the old solution. Thus the user can authenticate against privacyIDEA with the old, proprietary token, until a new token is enrolled for them in privacyIDEA. The interesting thing is, that you also get the authentication request with the proprietary token in the audit log of privacyIDEA. This way you can have a scenario, where users are still using old tokens and other users are already using new (privacyIDEA) tokens. You will see all authentication requests in the privacyIDEA system.