Execution Context

Variables available during request processing

Execution context in Radiator Server defines the set of variables and their structure that are available during the processing of a request. It provides access to various attributes related to the request, user, session, and environment, allowing for dynamic handling and customisation of request processing. Execution context is created at the beginning of request processing and is passed through the execution pipelines.

Supported namespaces

Below, '*' denotes any namespace, attribute name, or data type.

Various utility namespaces

Variable	Type	Access	Description
id	number	read	Request identifier
env.*	string	read	Process environment variables
vars.*	*	read/write	Custom variables
util.rand.X	bytes	read	Reads X bytes of random
datetime.timestamp	timestamp	read	Current time

Namespace `aaa`

Variable	Type	Access	Description
aaa.identity	string	read/write	Protocol-agnostic username/identity of the request
aaa.identity.name	string	read	Name part of current username/identity
aaa.identity.realm	string	read/write	Realm part of current username/identity
aaa.identity.realm.tld	string	read	TLD part of the realm
aaa.protocol	enum	read	Protocol of the request
aaa.trace	boolean	read	Is tracing enabled for the request?
aaa.accounting	boolean	read	Is the request an accounting request?
aaa.policy	string	read	Name of AAA policy handling the request
aaa.handler	string	read	Name of AAA policy handler handling the request
aaa.method	enum	read	Authentication protocol/method
aaa.message	string	read/write	Reply message for Accept/Reject responses
aaa.challenge-message	string	read/write	Challenge prompt message for Challenge responses
aaa.result	enum	read	AAA result
aaa.reason	string	read	Error or reason
aaa.errors	string array	read	All errors that occurred during request processing
aaa.caught_error	string	read/write	Most recent error caught by a try action
aaa.caught_errors	string array	read/write	All errors caught by try actions during request processing

Namespace `user`

Variable	Type	Access	Description
user.username	string	read/write	User entry's name
user.password	string	read/write	User's password
user.group	string array	read/write	User's groups
user.role	string array	read/write	User's roles
user.backend	string	read	Backend's name from which user was fetched

Namespace `acct`

Variable	Type	Access	Description
acct.status	enum	read	Accounting request status
acct.timestamp	timestamp	read	Accounting request timestamp
acct.duration	number	read	Accounting session duration in seconds
acct.input.packets	number	read	Accounting session packets in
acct.input.bytes	number	read	Accounting session bytes in
acct.output.packets	number	read	Accounting session packets out
acct.output.bytes	number	read	Accounting session bytes out

Namespace `auth`

Variable	Type	Access	Description
auth.protocol	enum	read/write	Authentication protocol
auth.challenge	string	read/write	Authentication challenge
auth.response	bytes	read/write	Authentication response
auth.result	string	read/write	Authentication result

Namespace `tls`

Variable	Type	Access	Description
tls.version	enum	read	Negotiated TLS protocol version
tls.cipher	enum	read	Negotiated TLS cipher

Namespace `cert`

Variable	Type	Access	Description
cert.valid	boolean	read	Did basic certificate validation succeed?
cert.error	string	read	Verification error
cert.server	string	read	In TLS client context, server's name or IP address
cert.issuer	string	read	Certificate's issuer's name
cert.subject	string	read	Certificate's subject's name
cert.serial	number	read	Certificate's serial number
cert.issued	timestamp	read	Certificate's issue timestamp
cert.expires	timestamp	read	Certificate's expiry timestamp
cert.policy	string array	read	Certificate's Policy OIDs
cert.sha256	bytes	read	SHA256 hash of the certificate
cert.issuer.*	string array	read	Issuer name's individual components (dc, c, st, l, o, ou, cn, emailaddress)
cert.subject.*	string array	read	Subject name's individual components (dc, c, st, l, o, ou, cn, emailaddress)
cert.subject_alt.*	string array	read	Subject's alternative names (email, dns, dn, uri, ip, oid, upn, other)
cert.ca.*	*	read	Certificate's first CA certificate
cert.ca[N].*	*	read	Certificate's Nth CA certificate

CA certificate has the same attributes as the cert.

Namespace `radius`

Variable	Type	Access	Description
radius.client	string	read	Client's name from which the request was received
radius.client.ip	ip	read	IP address from which the request was received
radius.server	string	read	Server's name which received the request
radius.server.tls	boolean	read	Was request received over TLS?
radius.request.attr.*	*	read/write	Radius request attributes
radius.reply.attr	json	write	Spread JSON object to reply attributes
radius.reply.attr.*	*	read/write	Radius reply attributes

Attribute's data type is defined by the RADIUS dictionary used. Examples:

Example	Description
radius.request.attr.user-name	User-Name attribute
radius.request.attr.tunnel-type:1	Tunnel-Type attribute with a tag value 1
radius.request.attr.framed-route[0]	First Framed-Route attribute
radius.request.attr.framed-route[n]	Last Framed-Route attribute
radius.request.attr.framed-route[*]	All Framed-Route attributes
radius.request.attr.cisco.avpair	Cisco AV-pair attribute
radius.reply.attr = vars.json_attrs	Spread JSON object keys as reply attribute names

Constants

The radius namespace provides named constants for RADIUS packet type codes. Use these instead of magic numbers for clearer configuration.

Packet Type Codes:

Constant	Value	Description
radius.ACCESS_REQUEST	1	Access-Request packet
radius.ACCESS_ACCEPT	2	Access-Accept packet
radius.ACCESS_REJECT	3	Access-Reject packet
radius.ACCOUNTING_REQUEST	4	Accounting-Request packet
radius.ACCOUNTING_RESPONSE	5	Accounting-Response packet
radius.ACCESS_CHALLENGE	11	Access-Challenge packet
radius.STATUS_SERVER	12	Status-Server packet
radius.DISCONNECT_REQUEST	40	Disconnect-Request packet
radius.DISCONNECT_ACK	41	Disconnect-ACK packet
radius.DISCONNECT_NAK	42	Disconnect-NAK packet
radius.COA_REQUEST	43	CoA-Request packet
radius.COA_ACK	44	CoA-ACK packet
radius.COA_NAK	45	CoA-NAK packet

Attribute Enum Values:

For attribute enum values (like Acct-Status-Type or Service-Type), use the radius.dict.<Attribute>.<Value> syntax to access dictionary-defined values:

# Acct-Status-Type values
radius.dict.Acct-Status-Type.Start       # 1
radius.dict.Acct-Status-Type.Stop        # 2
radius.dict.Acct-Status-Type.Alive       # 3

# Service-Type values
radius.dict.Service-Type.Login-User      # 1
radius.dict.Service-Type.Framed-User     # 2

Example usage:

if all {
    radius.request.code == radius.ACCESS_REQUEST;
} then {
    # Handle Access-Request
}

if all {
    radius.request.attr.acct-status-type == radius.dict.Acct-Status-Type.Start;
} then {
    # Handle Accounting Start
}

Namespace `radiusproxy`

Variable	Type	Access	Description
radiusproxy.server	string	read	Radius proxy server's name to which send the request
radiusproxy.server.tls	boolean	read	Is Radius proxy server using TLS connection?
radiusproxy.request.attr	json	write	Spread JSON object to proxy request attributes
radiusproxy.request.attr.*	*	read/write	Radius proxy request attributes
radiusproxy.reply.attr.*	*	read/write	Radius proxy reply attributes

Attribute's data type is defined by the RADIUS dictionary used. Examples:

Example	Description
radiusproxy.request.attr.user-name	User-Name attribute
radiusproxy.request.attr.operator-name	Operator-Name attribute
radiusproxy.request.attr.tunnel-type:1	Tunnel-Type attribute with a tag value 1
radiusproxy.request.attr.cisco.avpair[0]	First Cisco AV-pair attribute
radiusproxy.request.attr.cisco.avpair[n]	Last Cisco AV-pair attribute
radiusproxy.request.attr.cisco.avpair[*]	All Cisco AV-pair attributes
radiusproxy.request.attr = vars.json_attrs	Spread JSON object keys as proxy request attribute names

Namespace `eap`

Variable	Type	Access	Description
eap.identity	string	read	EAP identity
eap.method	enum	read	EAP method

Namespace `eap-ttls`

Variable	Type	Access	Description
eap-ttls.request.attr.*	*	read/write	EAP-TTLS request attributes
eap-ttls.reply.attr.*	*	read/write	EAP-TTLS request attributes

Attribute's data type is defined by the RADIUS dictionary used. Examples:

Example	Description
eap-ttls.request.attr.user-name	User-Name attribute
eap-ttls.request.attr.user-password	User-Password attribute
eap-ttls.request.attr.chap-password	CHAP-Password attribute
eap-ttls.request.attr.eap-message	EAP-Message attribute

Namespace `eap-teap`

Variable	Type	Access	Description
eap-teap.username	string	read	EAP-TEAP basic password authentication response username
eap-teap.identity-type	enum	read	EAP-TEAP Identity-Type TLV (user/machine)

Namespace `parent`

Variable	Type	Access	Description
parent.*	*	read/write	Parent context namespace

Examples:

Example	Description
parent.aaa.identity	AAA identity from parent context
parent.radius.client	RADIUS client from parent context

Namespace `tacacsplus`

Variable	Type	Access	Description
tacacsplus.type	number	read	TACACS+ packet type
tacacsplus.authentication	boolean	read	Is the request an authentication request?
tacacsplus.authorization	boolean	read	Is the request an authorization request?
tacacsplus.accounting	boolean	read	Is the request an accounting request?
tacacsplus.unencrypted	boolean	read	Is the packet unencrypted?
tacacsplus.session	number	read	TACACS+ session ID
tacacsplus.request.action	number	read	Request action
tacacsplus.request.privilege	number	read	Request privilege level
tacacsplus.request.authentication.method	number	read	Authentication method
tacacsplus.request.authentication.type	number	read	Authentication type
tacacsplus.request.authentication.service	number	read	Authentication service
tacacsplus.request.user	string	read	Request username
tacacsplus.request.port	string	read	Request port
tacacsplus.request.address	string	read	Request remote address
tacacsplus.request.data	bytes	read	Request data
tacacsplus.request.message	string	read	Request message
tacacsplus.request.arg[N]	string	read	Nth request argument
tacacsplus.request.args	string array	read	All request arguments
tacacsplus.reply.status	string	read/write	Reply status
tacacsplus.reply.noecho	boolean	read/write	Reply no-echo flag
tacacsplus.reply.message	string	read/write	Reply message
tacacsplus.reply.data	bytes	read/write	Reply data
tacacsplus.reply.arg[N]	string	write	Nth reply argument
tacacsplus.reply.args	string array	read/write	All reply arguments
tacacsplus.client	string	read/write	TACACS+ client name
tacacsplus.client.ip	ip	read	TACACS+ client IP address
tacacsplus.client.secret	bytes	write	TACACS+ client secret
tacacsplus.client.timeout	number	read/write	TACACS+ client timeout in milliseconds
tacacsplus.server	string	read	TACACS+ server name

Namespace `http`

Variable	Type	Access	Description
http.management	boolean	read	Is the request a management API request?
http.method	string	read	HTTP request method (GET, POST, etc.)
http.path	string	read	HTTP request path
http.path.N	string	read	Nth part of the HTTP path (0-based)
http.query	map	read	All HTTP query parameters
http.query.KEY	string	read	Specific HTTP query parameter value
http.body	bytes	read	HTTP request body
http.body.PATH	*	read	JSON path access to request body
http.header.NAME	string	read	HTTP request header value
http.headers.NAME	string	read	HTTP request header value (alias)
http.response	bytes	read/write	HTTP response body
http.response_header.NAME	string	read/write	HTTP response header value
http.status	string	read/write	HTTP response status code
http.json	boolean	read/write	Should response be JSON formatted?
http.authorization.username	string	read	Username from Authorization header
http.authorization.password	string	read	Password from Authorization header
http.authorization.bearer	string	read	Bearer token from Authorization header
http.client	string	read	HTTP client name
http.client.ip	ip	read	HTTP client IP address
http.server	string	read	HTTP server name
http.server.ip	ip	read	HTTP server IP address
http.server.tls	boolean	read	Is the HTTP connection using TLS?

Namespace `root`

Variable	Type	Access	Description
root.*	*	read/write	Root context namespace

Examples:

Example	Description
root.aaa.identity	AAA identity from root context
root.radius.client	RADIUS client from root context

Namespace `server`

Variable	Type	Access	Description
server.instance_id	string	read	Server instance's ID
server.cluster_id	string	read	Server's cluster ID
server.hostname	string	read	Hostname of server
server.version	string	read	Software version information