CA Strong Authentication Administration Guide › Managing Global CA AuthMinder Configurations › Configuring CA AuthMinder for RADIUS › Configure RADIUS Clients › Add RADIUS Clients

Add RADIUS Clients

Follow these steps:

1. Click the Services and Server Configurations tab on the main menu.
2. Verify that the CA Strong Authentication tab in the submenu is active.
3. Under the RADIUS section, click the RADIUS Client link to display the corresponding page.
4. Click Add to set up a RADIUS client configuration.
5. Provide the following information in the respective fields:
   • RADIUS Client IP Address: Specify the IP Address of the RADIUS client through which users authenticate to CA AuthMinder Server.
   • Shared Secret Key: Specify the secret key that is shared between the RADIUS client and the CA AuthMinder Server.

     Note: The minimum length of key is 1 and the maximum is 512 characters.

   • Description: Enter a string to describe the RADIUS client. The description helps to identify the RADIUS client, if multiple clients are configured.
   • Authentication Type: Select the authentication mechanism for VPN authentication:
     • RADIUS OTP: The default authentication mechanism that is used to authenticate RADIUS requests.
     • In-Band Password: Use this option in the following scenarios:
       To resolve credential type
       If you want to authenticate users with the credential that is configured using credential type resolution (see Resolving Credential Types). By default, password authentication mechanism is used.
       (Optional, applicable for Global Configurations Only) To specify the organization name
       In a RADIUS request, organization information can be sent with a password in the <orgname>\n<password> format. CA AuthMinder can extract the organization name from a password that is specified in this format. To enable the use of this feature, associate organizations with the RADIUS client as follows:

       a. Use the > button to move the required organizations from the Available Organizations list to the Supported Organizations list.

       b. Specify the Default Organization for the RADIUS client. If organization information is not presented in a RADIUS request, then this default organization is considered in the authentication to resolve user details.

     • EAP: This option is not currently supported. Do not select it.
6. In the RADIUS Retry Handling section, specify the following:
   • Select the Enable Retry option if you want the RADIUS client to try sending the request to CA AuthMinder Server if it does not receive any response.
   • In the Retry Window field, enter the duration in seconds within which the client can retry to connect to the CA AuthMinder Server if it does not receive any response. After this period, the retry is considered invalid. Ensure that the retry window period is greater than the client timeout period.
7. In the Additional RADIUS Response Attributes section, specify the attributes that you want the CA AuthMinder Server to include in the response sent to the RADIUS client.
   • Attribute ID: Enter a unique attribute identifier in this column. For example, 26.
   • Attribute Value: Enter the value corresponding to the attribute ID. You can pass static values or variables such as, user attributes or custom attributes, or a combination of static values and variables. For example, for the user JSmith, if the custom user attribute key-value pair is Employee ID=150, then you can include the employee ID in the RADIUS response, as follows:

   JSmith = $$Employee ID$$

   This returns JSmith = 150.

8. Click Add More to add more attributes.
9. In the RADIUS Packet Drop Options section, select the options when the CA AuthMinder Server must not process RADIUS packets.

   Following are the supported options to drop the RADIUS packets:

   • User not Found
   • Credential not Found
   • Invalid Request
   • Internal Error
10. Click Add to add the new RADIUS client.
11. Refresh all deployed CA AuthMinder Server instances. See Refresh a Server Instance for instructions about the procedure.