proxy_unknown_attributes

Use proxy_unknown_attributes in a radius or radius-dns-sd backend block to control whether proxy conversion forwards attributes that are not defined in the active RADIUS dictionary.

backends {
    radius "UPSTREAM" {
        proxy_unknown_attributes true;

        server "radius.example.com" {
            secret "shared-secret";
            connect {
                protocol udp;
                host "radius.example.com";
                port 1812;
            }
        }
    }
}

The value is a boolean. The default is false. With the default, Radiator drops dictionary-unknown attributes while copying a proxy request or reply. Known attributes continue to be copied and protected according to their dictionary definitions.

Set the value to true only when the peer requires private attributes that cannot be added to the dictionary. Radiator forwards an unknown attribute only when its wire representation can be preserved without assuming unknown protection rules. Conversion fails if an enabled unknown attribute cannot be translated safely between RADIUS/1.0 and RADIUS/1.1.

Adding private attributes to the RADIUS dictionary is preferred. A dictionary definition lets Radiator validate the value type and apply any required hop-by-hop protection when the packet profile or shared secret changes.