backends.radius.query.send_message_authenticator

send_message_authenticator

Use send_message_authenticator in a RADIUS backend query block to control whether the query sends a Message-Authenticator attribute.

query "COA" {
    send_message_authenticator false;

    bindings {
        radius.request.code = radius.COA_REQUEST;
        radius.request.attr.Acct-Session-Id = vars.session_id;
    }

    mapping {
        vars.reply_code = radius.reply.code;
    }
}

The parameter accepts true or false. The default is true.

When set to true, Radiator adds one Message-Authenticator as the first request attribute. When set to false, Radiator removes any Message-Authenticator attributes supplied by query bindings and sends the request without one.

For traditional RADIUS transports, disable Message-Authenticator only when an upstream server cannot process it. Disabling it weakens request integrity protection. Do not disable it for requests that carry EAP-Message attributes over traditional RADIUS transports because EAP requires Message-Authenticator.

See RADIUS backend query.