Radiator Server Documentation — v10.34.2

conditions

The conditions action evaluates a condition block and returns accept if the block matches, or reject if it does not. It is a shorthand for the common pattern of using an if block to accept or reject a request based on conditions.

The following conditions action:

conditions all {
    user.group == "admin";
    aaa.identity.realm == "example.com";
}

is equivalent to:

if all {
    user.group == "admin";
    aaa.identity.realm == "example.com";
} then {
    accept;
} else {
    reject;
}

Syntax

conditions <all | any | none> {
    <condition rules>
}

The condition block uses the all, any, or none matching strategy and can contain comparisons and nested condition blocks. For the matching strategies, nesting, evaluation order, and comparison operators, see Condition Blocks.

Examples

Certificate verification pipeline

Use conditions in a TLS verification pipeline to validate certificate fields:

@verification {
    conditions all {
        cert.subject.cn == "test.server.some.company.com";
        cert.subject.o == "OSC Demo Certificates";
        cert.issuer.cn starts "OSC Test CA";
        cert.subject_alt.dns ends ".some.company.com";
        cert.subject_alt.dns contains "server";
    }
}

Simple realm gate

Accept only requests for a specific realm:

@execute {
    conditions all {
        aaa.identity.realm == "corporate.example.com";
    }
}

See Also