Radiator Server Documentation — v10.34.2

send_message_authenticator

Set send_message_authenticator in a radius or radius_dns_sd backend block to control outgoing RADIUS/1.0 request signing. The default is true. It applies to proxy, query and reverse-query requests.

A server or DNS-SD server_template inherits the backend value unless it sets its own value. An explicit true or false overrides the backend default.

Set false to omit Message-Authenticator from non-EAP requests where it is optional. EAP requests and Status-Server probes always include it. When present, Radiator adds it as the first attribute.

Accounting-Request never includes it. RADIUS/1.1 uses TLS and does not include it.

The query setting can also disable optional signing for an individual query. Use require_message_authenticator to control incoming upstream responses independently.