How To: Hard Code a Static Value for a RADIUS Attribute

Version Affected: All

 

Overview

A RADIUS client can need a static value passed to it from the RADIUS Server. The Global Aux ID field on the realm's Data tab is designed for this, but a known bug in the RADIUS Server prevents it from reading that field's value. This article describes a workaround: hard-coding the static value into one of the realm's other, unused AuxID fields instead.

Hard Code a Value Using an Unused AuxID Field

1. Pick an AuxID field that isn't currently in use -- for example, AuxID3.
2. In the realm's web.config, add defaultValue="<value>" to that field's element, just before the closing />. For example, to hard-code the value test into AuxID3:

<add name="AuxID3" defaultValue="test" />

3. On the RADIUS client's Data Attribute Mapping settings, map the AuxID field to the RADIUS Attribute needed for the configuration.

Special Considerations

A common real-world use of this technique: Cisco switches need a specific value, shell:priv-lvl=15, passed to them to let a user log in with Privileged (Enable) Mode. Hard-code that value into an unused AuxID field as described above:

Then, on the RADIUS server, configure Custom Attribute Mapping to send it as a Cisco Vendor-Specific Attribute: map the AuxID field to Vendor ID 9 (Cisco), Attribute 26 (Vendor-Specific), with Field Type set to string:

A tool like NTRadPing can confirm the mapping is working -- the RADIUS server's reply includes the Cisco attribute with the mapped value:

See Cisco's RADIUS Attributes Configuration Guide for more on Vendor-Specific Attributes.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.