backend

backend

Call a backend to fetch user authentication information.

backend {
    name "DB";
    query "FIND_USER";
    args {
        identity = aaa.identity;
    }
}

The query statement is optional and may be omitted if the backend does not support multiple queries. In that case also the short form may be used:

backend "DB";

Result

Depending on the backend the backend action may return accept, reject or ignore.

Parameters

args

Pass request-local values to backend query expressions. Each argument has a simple name and one expression. Use the value through the read-only args namespace:

backend {
    name "DB";
    query "FIND_USER";
    args {
        identity = aaa.identity;
        site = radius.request.attr.NAS-Identifier;
    }
}

Radiator evaluates all right-hand expressions in the caller context before it installs any arguments. The arguments remain available while Radiator resolves a dynamic query name, executes the backend, and processes its result. Nested backend calls receive a separate argument scope and restore the caller's scope when they finish. Attempts to set, append, replace, or remove args.* values fail during configuration compilation.

Backend query expressions can read these values through the args namespace.

@each

Run a pipeline once for each result returned by the backend action. The pipeline can access the result variables provided by the backend. Each backend documents its result variables separately.

Use continue; to skip the remaining actions for the current result and proceed with the next result. Use break; to skip the remaining actions and stop processing all remaining results. These actions are valid only inside an @each pipeline.

@once

Run a pipeline when the backend returns exactly one result. The pipeline can access the same backend result variables as @each. The backend call errors if it returns no results or more than one result.

A backend action can configure either @each or @once, but not both.

timeout

Sets the maximum time the action waits for a backend reply. The maximum is 65535ms. If omitted, the action adds no deadline, but the backend's own timeouts still apply. For RADIUS DNS-SD, service discovery uses the shorter of this value and the configured dns-timeout.

This parameter supports duration units.

secret

For backends that verify a PAP-style secret — such as a proxied RADIUS backend that needs a User-Password to forward, an NTLM/LSA backend, or the YubiKey cloud OTP backend — the optional secret parameter supplies the value the backend should authenticate. Combine it with the filter pipeline to derive that value from any context attribute.

# Strip a trailing 6-digit OTP from the PAP password before forwarding the
# remaining static password to an upstream RADIUS server.
backend {
    name "UPSTREAM_RADIUS";
    secret radius.request.password | substring(0, -6);
}

When secret is set, its value replaces the protocol PAP response that the backend would otherwise see. For backend queries with multiple inputs, use the query's own bindings { ... } block instead — each binding is a full expression and can use the filter pipeline.

range

Slices the PAP authentication response by character offsets before passing it to the backend. Prefer secret with the filter pipeline for new configurations; range is limited to a single contiguous slice and remains supported mainly for backward compatibility.

Syntax: range <start> <end> [exclusive]

• <start> - Starting index (negative values count from end)
• <end> - Ending index (negative values count from end)
• exclusive - Optional keyword to invert the range and keep everything except the specified slice
• Indices are 0-based

# Pass only the last 6 characters, such as a TOTP code, to the backend.
backend {
  name "OTP_BACKEND";
  range -6 0;
}

timeout

Sets the maximum duration that the backend action waits for a response. By default, the action has no timeout.

backend {
  name "UPSTREAM_RADIUS";
  timeout 15s;
}