aaa.policy.handler.@post-authentication

@post_authentication

Variant of @post_execute for @authentication which is only executed for authentication requests. This is executed regardless of whether the main @authentication pipeline accepted or rejected the request, but is skipped if the @pre_authentication pipeline rejected the request.

Note: The @ prefix is required for pipeline blocks. The legacy syntax without @ (e.g., post_authentication {}) is deprecated and emits warnings. Use @post_authentication {} for new configurations.

Result of this pipeline is ignored; it cannot change the outcome of the request. However, it can modify the reply attributes, log information, or perform other side effects.

aaa.result exposes the corresponding @authentication pipeline result here. Use "%{aaa.result}" to compare its lowercase name; direct access is numeric.

See also

• Execution context - Available variables
• Execution pipelines - Pipeline actions and control flow
• until - Control flow

Example

logging {
    aaa {
        logger "EVENTS" {
            console;
        }
    }
}

aaa {
    policy "RADIUS" {
        conditions all {
            aaa.protocol == protocol.RADIUS;
        }

        handler "EXAMPLE" {
            @post_authentication {
                if all {
                    "%{aaa.result}" == "accept";
                } then {
                    log "EVENTS" {
                        json {
                            "message" "User authenticated";
                            "username" user.username;
                        }
                    }
                }
            }
        }
    }
}