Policy Server Guides › Policy Server Management Guide › Using the Policy Server as a RADIUS Server › Responses in RADIUS Policy Domains › Create Attributes for Agent Types › Define Multiple Instances of an Attribute

Define Multiple Instances of an Attribute

You can define multiple instances of a vendor-specific attribute for the same Agent type. When you define multiple instances of a vendor-specific attribute, you can send a different value to the NAS device for each instance of the attribute. For example, for a Cisco Agent, you could define the following vendor-specific attributes, all using the same identifier (26):

• Cisco-AVpair
• Account-Info
• Command-Code

The settings that define the number of times an attribute can be used within a response are located on the Properties tab of the Agent Attribute Properties dialog box.

To configure the attribute to be used multiple times, the Access Accept value must be set to Zero or Many.

The type of attribute that you define must match the vendor type of the Agent returning the response. For example, a vendor-specific Cisco attribute can only be returned by a Cisco Agent.

When the response is returned by the Agent, the packet structure of the response reflects the type of RADIUS Agent that sent the response. For example, the packet structure of a response returned by a Cisco Agent would include the vendor ID and the length of the string.

To define an attribute for an Agent type

1. In the Policy Server User Interface, choose Agent Types from the View menu.

   The Agent Types icon appears in the System Configuration list in the left pane.

2. Click the Agent Types icon.

   The SiteMinder Agent types List appears.

3. Double click the Agent type for which you want to configure a vendor-specific, RADIUS, or extended RADIUS attribute.

   The Agent Type Properties dialog box appears.

4. Select the Agent Type Attributes tab to move it to the front.
5. Click the Create button to create a new attribute.

   The SiteMinder Agent Attribute dialog box appears.

6. From the RADIUS Type drop-down list, select the appropriate type of attribute (Vendor specific, RADIUS Extended, or RADIUS).

   Note: More information about attribute types exists in Attribute Types.

7. From the Data Type drop-down list, select the type of data the attribute contains.
8. In the Identifier field, enter one of the following attribute identifiers:
   • Generic RADIUS-- enter the attribute id as defined in the RADIUS protocol specification. For example, to create an attribute for the Callback-Id variable, enter 20.

     Although it is possible to overwrite the identifier of a Generic RADIUS attribute, you should generally retain the pre-defined Generic RADIUS attribute definitions, which match the RADIUS specification (RFC 2138).

   • RADIUS Extended--enter the attribute identifier as defined by the vendor documentation. For example, to create an attribute for the Ascend-Callback attribute, enter 246.
   • Vendor-Specific--enter 26. For example, to create an attribute for a Cisco Agent that enables the Agent to use TACACS+, enter 26.

   Note: For more information about the attribute identifiers, see your RADIUS vendor documentation.

9. In the RADIUS Behavior group box, define the RADIUS codes using the following fields:

   Access Request

   Provides information used to determine whether or not a user is allowed access to a specific NAS. The Access Request packets also provide information for any special services requested for that user.

   Access Accept

   Provides specific configuration information necessary to begin delivery of service to the user.

   Note: You must set the Access Accept value to Zero or One, Zero or Many, or One and Only One in order to use the attribute in a response.

   Access Reject

   Sends information if any value of the received Attributes is not acceptable. This code is often used for reply messages.

   Access Challenge

   Sends information if the NAS device has been configured for challenge/response.

   Accounting Request

   Describes the type of service being delivered and the user to whom it is being delivered.

   Accounting Response

   Sends information if the Accounting Request was recorded successfully. A RADIUS Accounting-Response is not required to have any attributes in it.

   For each code, you can define one of the following occurrences:

   Not allowed

   Attribute cannot be used in a response.

   Zero or One

   One instance or no instances of the attribute can be returned in the same response. If this value is selected, and you use the attribute in a response, the attribute will be removed from the Attribute drop-down list after you have used the attribute in a response.

   Zero or Many

   Multiple instances or no instances of the attribute can be returned in the same response.

   One and Only One

   One instance of the attribute must be returned in a response. If this value is selected, and you use the attribute in a response, the attribute will be removed from the Attribute drop-down list after you have used the attribute in a response.

10. If you selected Number from the Data Type drop-down list, click on the Value tab to assign possible values to the attribute.

    Use this tab to define a list of pre-defined values from which the user can choose when configuring the attribute in a response. The values are used in the Response Attribute dialog box, which is used when configuring a response.

    By mapping the symbolic names to the values, it is easier to use the attribute in a response, rather than having to remember the actual numeric values.

11. Click the Create button to define a value in the Agent Attribute Value dialog box.
12. In the Name field, enter the symbolic name of the attribute.
13. In the Numeric Value field, enter the actual numeric value of the attribute.
14. Click OK to save the attribute definition.
15. Click OK to save the attribute and close the Agent Attributes Properties dialog box.

    The attribute is added to the Agent Type Attributes list.

16. Click OK to save the Agent Type definition.

    The attribute is added to the properties of the Agent type. When you configure a response for this Agent type, you can use this attribute by selecting it from the Response Editor dialog box shown.

17. Define the attribute in the response.

More information:

Define the Response