How To: Hard Code a Static Value for a RADIUS Attribute – SecureAuth Support

Version Affected: All

Overview

A RADIUS client can need a static value passed to it from the RADIUS Server. The Global Aux ID field on the realm's Data tab is designed for this, but a known bug in the RADIUS Server prevents it from reading that field's value. This article describes a workaround: hard-coding the static value into one of the realm's other, unused AuxID fields instead.

Hard Code a Value Using an Unused AuxID Field

Pick an AuxID field that isn't currently in use -- for example, AuxID3.
In the realm's web.config, add defaultValue="<value>" to that field's element, just before the closing />. For example, to hard-code the value test into AuxID3:

<add name="AuxID3" defaultValue="test" />

The realm's Web Config Editor, with defaultValue="test" added to the AuxID3 element.

On the RADIUS client's Data Attribute Mapping settings, map the AuxID field to the RADIUS Attribute needed for the configuration.

Data Attribute Mapping, with IdP field auxId3 mapped to RADIUS Attribute Tunnel-Type as an example.

Special Considerations

A common real-world use of this technique: Cisco switches need a specific value, shell:priv-lvl=15, passed to them to let a user log in with Privileged (Enable) Mode. Hard-code that value into an unused AuxID field as described above:

The realm's Web Config Editor, with defaultValue="shell:priv-lvl=15" added to the AuxID3 element.

Then, on the RADIUS server, configure Custom Attribute Mapping to send it as a Cisco Vendor-Specific Attribute: map the AuxID field to Vendor ID 9 (Cisco), Attribute 26 (Vendor-Specific), with Field Type set to string:

Custom Attribute Mapping, with IdP Property auxId3 mapped to Vendor ID 9 and Attribute 26, Field Type string.

A tool like NTRadPing can confirm the mapping is working -- the RADIUS server's reply includes the Cisco attribute with the mapped value:

NTRadPing Test Utility showing a RADIUS server reply containing vendor Cisco cisco-h323-call-origin=shell:priv-lvl=15.

See Cisco's RADIUS Attributes Configuration Guide for more on Vendor-Specific Attributes.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.