@pre-authentication

Variant of @pre-execute for @authentication which is only executed for authentication requests. If this pipeline rejects, the main @authentication and @post-authentication pipelines are skipped, and the request is rejected immediately.

Note: The @ prefix is required for pipeline blocks. The legacy syntax without @ (e.g., pre-authentication {}) is deprecated and emits warnings. Use @pre-authentication {} for new configurations.

See also

• Execution context - Available variables
• Actions - Available actions
• Pipeline directives - Control flow

Example

@pre-authentication {
    if all {
        aaa.identity =~ /@example\.com$/;
    } then {
        set aaa.identity = aaa.identity.name;
    }
}