clients.send_message_authenticator

send_message_authenticator

Set send_message_authenticator in a RADIUS client block to control Message-Authenticator in outgoing RADIUS/1.0 replies. The default is true.

Supported replies include Access-Accept, Access-Reject, Access-Challenge, CoA-Ack/Nak and Disconnect-Ack/Nak. They include it as the first attribute, including access replies to Status-Server. Set false to omit optional signing for non-EAP exchanges. Requests or replies containing EAP-Message always require it.

Accounting-Response never includes Message-Authenticator. RADIUS/1.1 uses TLS and does not include it.

Use require_message_authenticator to control incoming requests independently. Pipelines can set radius.client.send_message_authenticator for the selected client.