Execution Context

Execution context in Radiator Server defines the variables that are available during pipeline execution. Some utility variables are available in all pipeline contexts. Request and protocol variables are available only when the pipeline has an inbound request or when an action creates the relevant context.

Configuration-load expressions are separate from runtime execution context. They support only a small subset of names in places where the parser accepts simple expressions, such as env.* and server.*.

Always-available utilities

Below, '*' denotes any namespace, attribute name, or data type.

These variables are available in request pipelines and in non-request pipelines, such as @init and timer pipelines.

id is a random 64-bit context identifier. Bare id evaluates to the numeric value. In format strings and log context fields, it is rendered as a 16-character lowercase hexadecimal string. Use it to correlate log entries that come from the same request, timer tick, or init pipeline execution.

Namespace datetime

The datetime.* namespace returns the current time during pipeline execution. Use it in logs, cache values, backend mappings, and other runtime expressions that need a timestamp. For timestamp formats and comparisons, see Timestamps.

Examples:

2026-06-15T14:22:31.123456789+03:00
2026-06-15T11:22:31.123456789Z

To get the current day in YYYY-MM-DD format, use the timestamp_format() filter. For more timestamp handling examples, see Timestamps:

@init {
    log "SYSTEM" {
        json {
            "current_day" datetime.timestamp | timestamp_format("[year]-[month]-[day]");
        }
    }
}

datetime.* is a runtime namespace. It is available in request pipelines and non-request pipelines, such as @init and timer pipelines. It is not available in configuration-load expressions, such as file names.

Namespace env

The env.* namespace reads process environment variables. Use it to set deployment-specific values, such as file names and directories, outside configuration files.

Use the default() filter when a variable may be unset. In configuration-load expressions, this is useful for file paths:

logging {
    application {
        file {
            filename "%{env.RADIATOR_LOG_DIR | default("/var/log/radiator")}/radiator-server.log";
        }
    }
}

For configuration-load expressions, env.* supports default(). Other filters are available only in runtime pipeline expressions.

Namespace server

Namespace util

The util.* namespace provides read-only helper values.

When used in a format string, random bytes are rendered as lowercase hexadecimal:

@init {
    log "SYSTEM" {
        json {
            "trace_id" "%{util.rand.16}";
        }
    }
}

Namespace vars

The vars.* namespace stores custom pipeline-local variables. It starts empty for each new pipeline context. Use actions such as modify to set values and reuse them later in the same context.

@init {
    modify {
        vars.current_year = datetime.timestamp | timestamp_format("[year]");
    }

    log "SYSTEM" {
        json {
            "current_year" vars.current_year;
        }
    }
}

Variables in vars.* are not predefined. In non-request pipelines, each @init block gets its own vars.* values, and each timer tick gets a fresh context.

Runtime namespaces

Runtime namespaces are evaluated while a pipeline runs. Request pipelines get request, user, session, and protocol namespaces. Non-request pipelines, such as @init and timer, do not have request-scoped namespaces unless an action creates them.

Namespace aaa

Namespace user

user.* represents the current user context used by the active AAA handler. In most authentication flows, these values are populated from backend query mappings (for example, mapping database fields into user.username and user.password) and can then be updated by pipeline logic.

Namespace acct

Namespace auth

auth.* represents authentication exchange state for the current request. These values are derived from the incoming protocol request and authentication method parsing (PAP/CHAP/MS-CHAP/etc.) during request handling.

Supported values for auth.protocol:

auth.challenge and auth.response are protocol-dependent values. Use auth.password when you explicitly need a cleartext password input in PAP flows.

Namespace tls

Namespace cert

CA certificate has the same attributes as the cert.

Namespace radius

Attribute's data type is defined by the RADIUS dictionary used. Examples:

When radius.request.attr or radius.reply.attr is read without a specific attribute name, it returns all dictionary attributes as a JSON array of objects with name and value fields. Enum-typed attribute values are resolved to their dictionary names. This is useful for logging all attributes in a single field:

log "AUTHENTICATION" {
    json {
        "request_attrs" radius.request.attr;
        "reply_attrs" radius.reply.attr;
    }
}

The resulting JSON array looks like:

[
  { "name": "user-name", "value": "mikem" },
  { "name": "service-type", "value": "framed-user" }
]

Constants

The radius namespace provides named constants for RADIUS packet type codes. Use these instead of magic numbers for clearer configuration.

Packet Type Codes:

Attribute Enum Values:

For attribute enum values (like Acct-Status-Type or Service-Type), use the radius.dict.<Attribute>.<Value> syntax to access dictionary-defined values:

# Acct-Status-Type values
radius.dict.Acct-Status-Type.Start       # 1
radius.dict.Acct-Status-Type.Stop        # 2
radius.dict.Acct-Status-Type.Alive       # 3

# Service-Type values
radius.dict.Service-Type.Login-User      # 1
radius.dict.Service-Type.Framed-User     # 2

Example usage:

if all {
    radius.request.code == radius.ACCESS_REQUEST;
} then {
    # Handle Access-Request
}

if all {
    radius.request.attr.acct-status-type == radius.dict.Acct-Status-Type.Start;
} then {
    # Handle Accounting Start
}

Namespace radiusproxy

Attribute's data type is defined by the RADIUS dictionary used. Examples:

Namespace eap

Namespace eap-ttls

Attribute's data type is defined by the RADIUS dictionary used. Examples:

Namespace eap-teap

Namespace parent

Access the parent context from the child context.

Available for example in the inner @-pipelines of the eap action.

Examples:

Namespace tacacsplus

TACACS+ Constants:

Use root constants for packet type and supported wire version comparisons:

tacacsplus.AUTHENTICATION      # 1
tacacsplus.AUTHORIZATION       # 2
tacacsplus.ACCOUNTING          # 3
tacacsplus.VERSION_MAJOR       # 12
tacacsplus.VERSION_MINOR_DEFAULT # 0
tacacsplus.VERSION_MINOR_ONE   # 1

RFC-style TACACS+ enum constants are also available directly under tacacsplus.*:

tacacsplus.AUTHENTICATION_ACTION_LOGIN
tacacsplus.AUTHENTICATION_ACTION_CHPASS
tacacsplus.AUTHENTICATION_ACTION_SENDAUTH

tacacsplus.AUTHENTICATION_TYPE_NOT_SET
tacacsplus.AUTHENTICATION_TYPE_ASCII
tacacsplus.AUTHENTICATION_TYPE_PAP
tacacsplus.AUTHENTICATION_TYPE_CHAP
tacacsplus.AUTHENTICATION_TYPE_MSCHAP
tacacsplus.AUTHENTICATION_TYPE_MSCHAPV2

tacacsplus.AUTHENTICATION_SERVICE_NONE
tacacsplus.AUTHENTICATION_SERVICE_LOGIN
tacacsplus.AUTHENTICATION_SERVICE_ENABLE

Use dictionary-style constants for TACACS+ authentication enums:

tacacsplus.dict.action.login
tacacsplus.dict.action.change-password
tacacsplus.dict.action.send-authentication

tacacsplus.dict.authentication.method.tacacsplus
tacacsplus.dict.authentication.type.not-set
tacacsplus.dict.authentication.type.ascii
tacacsplus.dict.authentication.service.enable

Example usage:

if all {
    tacacsplus.type == tacacsplus.AUTHENTICATION;
    tacacsplus.request.action == tacacsplus.AUTHENTICATION_ACTION_CHPASS;
} then {
    # Handle TACACS+ ASCII change-password flow
}

if all {
    tacacsplus.request.authentication.service == tacacsplus.AUTHENTICATION_SERVICE_ENABLE;
    tacacsplus.version.minor == tacacsplus.VERSION_MINOR_DEFAULT;
} then {
    # Handle TACACS+ enable request
}

if all {
    tacacsplus.request.authentication.type == tacacsplus.AUTHENTICATION_TYPE_NOT_SET;
} then {
    # Handle RFC-style authen_type = 0 requests
}

Namespace http

For HTTP response behavior and examples, see docs/configuration/servers.http.md.

Constants

The http namespace provides named constants for standard HTTP status codes. Use these instead of raw numbers for clearer configuration. Constants are read-only and resolve to their numeric values at runtime.

1xx Informational:

2xx Success:

3xx Redirection:

4xx Client Errors:

5xx Server Errors:

Example usage:

modify http.status = http.TOO_MANY_REQUESTS;
modify http.status = http.INTERNAL_SERVER_ERROR;

Namespace yubikey

Context variables for Yubico OTP offline authentication. See YubiKey Context Variables for the full variable reference.

Namespace root

Examples:

Namespace errors

The errors namespace provides compile-time-validated constants for machine-readable error codes. Use these constants when comparing against aaa.caught_error.code to branch on specific error conditions caught by the try action. The namespace is read-only.

Constants

See the try action documentation for usage examples.