How To: Send Group Membership Back in a RADIUS Attribute

Version Affected: All

 

Overview

This article explains how to configure RADIUS to send back a user's group membership in a RADIUS attribute, so that a RADIUS client (for example, a VPN server) can apply different policies or VPN profiles based on group membership.

Configure Group Membership Mapping

1. Open the SecureAuth RADIUS admin console.
2. Click the RADIUS Clients tab.
3. Click the relevant RADIUS client.
4. In the Data Attribute Mapping section, click the + icon to add a mapping.
5. Map GroupList to Class, as shown below.

6. Open the Identity Platform (IdP) admin console and click the Data tab for the realm that RADIUS uses.
7. Ensure the Groups property is mapped to the Active Directory (AD) attribute memberOf (assuming the data store is AD), as shown below.

Special Considerations

This mapping returns the full distinguished names of the groups. When a user is a member of many groups, or the groups are deeply nested, this can quickly produce a large value. This is particularly relevant for RADIUS, because the RADIUS User Datagram Protocol (UDP) packet size is limited to 4KB. If the resulting RADIUS packet exceeds 4KB, the RADIUS client (for example, a VPN server) will not see it as an Access-Accept, and the authentication attempt will be rejected.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.