scripts.radconf.variables

RadConf variable access

Use radconf.get() and radconf.set() to read and write variables by their RadConf accessor paths. Both functions operate on the script's current request. Keep the original namespace and field names in each path:

local identity = radconf.get("aaa.identity")
local realm = radconf.get("aaa.identity.realm")

radconf.set("aaa.identity", "alice@example.com")
radconf.set("aaa.identity.realm", "example.net")

get(path)

radconf.get(path) returns a Lua value for a scalar accessor. Missing scalar values return nil. Multivalue accessors return a sequence table, including an empty sequence when no values are present. Map accessors return a table whose entries are multivalue sequences.

set(path, value)

radconf.set(path, value) creates a value if none is set, or overwrites the existing value. For a multivalue variable, it replaces all existing values. It does not append to them.

Use a new name under vars to create a user-defined variable:

radconf.set("vars.label", "first") -- Creates the variable.
radconf.set("vars.label", "updated") -- Overwrites its previous value.

Some variables, such as the constant protocol.RADIUS, are read-only. Trying to change a read-only variable or using an invalid path raises a Lua error.

Clear or remove a value

Pass nil to clear a value. For a user-defined variable, this removes the variable. Some built-in variables require a value and cannot be cleared.

radconf.set("aaa.identity", nil) -- Clears the identity.
radconf.set("vars.label", nil) -- Removes the user-defined variable.

Remove values from a list

Read the multivalue sequence, remove entries with table.remove(), then pass the modified sequence to set(). For example, remove every guest group:

local groups = radconf.get("user.group")

for i = #groups, 1, -1 do
    if groups[i] == "guest" then
        table.remove(groups, i)
    end
end

radconf.set("user.group", groups)

Iterate backwards so removing an entry does not skip the next value. table.remove() keeps the remaining indices consecutive. Changes to the returned table affect the request only after set() writes them back. Writing an empty sequence clears the variable if it supports clearing. An ordinary Lua table such as {} represents one JSON value, as described in multivalue sequences.

Remove a field from a JSON object

Assign nil to a Lua table field to remove it. If the HTTP request body is a JSON object, remove an optional field and write the changed object back:

local document = radconf.get("http.request")
document.optional_field = nil
radconf.set("http.request", document)

Use radconf.null to keep a field present with the JSON value null.

Enum values and named constants

Numeric RadConf enums and named constants become native Lua integers. Read a constant with radconf.get() using its RadConf path. For example, compare the request's protocol with the RADIUS constant:

local protocol = radconf.get("aaa.protocol")
local radius = radconf.get("protocol.RADIUS")
print(protocol == radius)

This differs from context.aaa.protocol, which returns a string such as "radius" for compatibility. See AAA protocol for the available protocol constants.

For a RADIUS request, read dictionary enum constants with radius.dict.<Attribute>.<Value>. Attribute accessors return multivalue sequences; select an entry to compare it with a constant:

local login_user = radconf.get("radius.dict.Service-Type.Login-User")
local service_types = radconf.get("radius.request.attr.Service-Type")
print(service_types[1] == login_user)

radconf.set("radius.reply.attr.Service-Type", login_user)

RADIUS enum attribute setters also accept the dictionary value name:

radconf.set("radius.reply.attr.Service-Type", "Login-User")

The target attribute's dictionary resolves "Login-User" to its numeric code. Lua strings are not evaluated as RadConf expressions. To use a constant path, read it with get() and pass the result to set(), as shown above. Named constants are read-only.

Values

Lua strings remain literal strings. For example, "42", "none", and "%{aaa.identity}" are not automatically interpreted as RadConf expressions.

See value conversions for JSON, binary data, multivalue sequences, and values such as passwords and timestamps. Use variable-backed filter chains to transform a variable before writing it back.