CA AuthMinder Administration Guide › Managing Global AuthMinder Configurations › Configuring AuthMinder for RADIUS › Configuring RADIUS Clients › Adding RADIUS Clients

Adding RADIUS Clients

To configure RADIUS clients for an organization:

1. Ensure that you are logged in with the required permissions and scope.
2. Activate the Services and Server Configurations tab on the main menu.
3. Ensure that the WebFort tab in the submenu is active.
4. Under the RADIUS section, click the RADIUS Client link to display the corresponding page.
5. Click Add to set up a RADIUS client configuration.
6. Provide the following information in the respective fields:
   • RADIUS Client IP Address: The IP Address of the RADIUS client through which users authenticate to AuthMinder Server.
   • Shared Secret Key: The secret key that is shared between the RADIUS client and the AuthMinder Server.

     Note: The minimum length of key is 1 and the maximum is 512 characters.

   • Description: Enter a string to describe the RADIUS client. The description helps to identify the RADIUS client, if multiple clients are configured.
   • Authentication Type: Select the authentication mechanism that will be used for VPN authentication:
     • RADIUS OTP: The default authentication mechanism that is used to authenticate RADIUS requests.
     • In-Band Password: Use this option in the following scenarios:
       
       To resolve credential type
       If you want to authenticate users with the credential that is configured using credential type resolution (see "Resolving Credential Types"). By default, password authentication mechanism is used.
       
       (Optional, applicable for Global Configurations Only) To specify the organization name
       In a RADIUS request, organization information can be sent with a password in the <orgname>\n<password> format. AuthMinder can extract the organization name from a password that is specified in this format. To enable the use of this feature, associate organizations with the RADIUS client as follows:

       a. Use the > button to move the required organizations from the Available Organizations list to the Supported Organizations list.

       b. Specify the Default Organization for the RADIUS client. If organization information is not presented in a RADIUS request, then this default organization is considered in the authentication to resolve user details.

     • EAP: This option is not currently supported. Do not select it.
7. In the RADIUS Retry Handling section, specify the following:
   • Select the Enable Retry option if you want the RADIUS client to try sending the request to AuthMinder Server if it does not receive any response.
   • In the Retry Window field, enter the duration in seconds within which the client can retry to connect to the AuthMinder Server if it does not receive any response. After this period, the retry is considered invalid. Ensure that the retry window period is greater than the client timeout period.
8. In the Additional RADIUS Response Attributes section, specify the attributes that you want the AuthMinder Server to include in the response sent to the RADIUS client.
   • Attribute ID: Enter a unique attribute identifier in this column. For example, 26.
   • Attribute Value: Enter the value corresponding to the attribute ID. You can pass static values or variables such as, user attributes or custom attributes, or a combination of static values and variables. For example, for the user JSmith, if the custom user attribute key-value pair is Employee ID=150, then you can include the employee ID in the RADIUS response, as follows:

   JSmith = $$Employee ID$$

   This returns JSmith = 150.

9. Click Add More to add more attributes.
10. In the RADIUS Packet Drop Options section, select the options when the AuthMinder Server must not process RADIUS packets.

    Following are the supported options to drop the RADIUS packets:

    • User not Found
    • Credential not Found
    • Invalid Request
    • Internal Error
11. Click Add to add the new RADIUS client.
12. Refresh all deployed AuthMinder Server instances. See "Refreshing a Server Instance" for instructions about the procedure.