@execute

Execution pipeline that is executed for all requests regardless of request type. Use this block for authentication, authorization, and accounting logic. Rejecting from this pipeline will reject the request immediately.

Note: The @ prefix is required for pipeline blocks. The legacy syntax without @ (e.g., execute {}) is deprecated and emits warnings. Use @execute {} for new configurations.

See also

Example

Use handler conditions to target specific request types, then process them in @execute:

policy "DEFAULT" {
    handler "AUTHENTICATION" {
        conditions all {
            radius.request.code == radius.ACCESS_REQUEST;
        }

        @execute {
            backend "USERS";
            pap;
        }

        @final-execute {
            log "AUTH" {
                format "user=%{aaa.identity} result=%{aaa.result}";
            }
        }
    }

    handler "ACCOUNTING" {
        conditions all {
            radius.request.code == radius.ACCOUNTING_REQUEST;
        }

        @execute {
            accept;
        }

        @final-execute {
            # Store accounting data to a database
        }
    }
}
Navigation
Home
Related