backends.radius.require_message_authenticator

require_message_authenticator

Use require_message_authenticator in a radius or radius-dns-sd backend block to require Message-Authenticator in received RADIUS/1.0 response types that support the attribute.

backends {
    radius "UPSTREAM" {
        require_message_authenticator true;

        server "radius.example.com" {
            secret "shared-secret";
            connect {
                protocol udp;
                host "radius.example.com";
                port 1812;
            }
        }
    }
}

The value is a boolean. The default is false for compatibility with RADIUS servers that do not send Message-Authenticator in every response.

When set to true, Radiator rejects a RADIUS/1.0 response that omits Message-Authenticator. Radiator also validates the attribute and the Response Authenticator before accepting the response. The setting applies to proxy, query, and reverse-query responses whose packet type supports Message-Authenticator.

The setting does not require Message-Authenticator in Accounting-Response, which does not support the attribute, or in replies to Radiator's Status-Server compatibility probes.

The setting does not apply to RADIUS/1.1. RADIUS/1.1 authenticates the connection with TLS and forbids Message-Authenticator.

This setting controls received responses. Use send_message_authenticator to control Message-Authenticator in requests created by a backend query.