aaa.policy.handler.@post-authorization

@post_authorization

Variant of @post_execute for @authorization which is only executed for authorization requests. This is executed regardless of whether the main @authorization pipeline accepted or rejected the request, but is skipped if the @pre_authorization pipeline rejected the request.

Note: The @ prefix is required for pipeline blocks. The legacy syntax without @ (e.g., post_authorization {}) is deprecated and emits warnings. Use @post_authorization {} for new configurations.

Result of this pipeline is ignored; it cannot change the outcome of the request. However, it can modify the reply attributes, log information, or perform other side effects.

aaa.result exposes the corresponding @authorization pipeline result here. Use "%{aaa.result}" to compare its lowercase name; direct access is numeric.

See also

• Execution context - Available variables
• Execution pipelines - Pipeline actions and control flow
• until - Control flow

Example

logging {
    aaa {
        logger "EVENTS" {
            console;
        }
    }
}

aaa {
    policy "RADIUS" {
        conditions all {
            aaa.protocol == protocol.RADIUS;
        }

        handler "EXAMPLE" {
            @post_authorization {
                if all {
                    "%{aaa.result}" == "accept";
                } then {
                    log "EVENTS" {
                        json {
                            "message" "User authorized";
                            "username" user.username;
                        }
                    }
                }
            }
        }
    }
}