summaryrefslogtreecommitdiff
path: root/interface-definitions
diff options
context:
space:
mode:
authorzsdc <taras@vyos.io>2023-09-13 12:41:04 +0300
committerzsdc <taras@vyos.io>2023-11-20 18:44:31 +0200
commit2a023b878471500bd78962ca94d9174a328ce5c9 (patch)
tree2d3ccd8d77cb6410d943395b72a963f07a0c5e70 /interface-definitions
parent9cf2f2c8019b0d0279d6af942a08b6bd829daa16 (diff)
downloadvyos-1x-2a023b878471500bd78962ca94d9174a328ce5c9.tar.gz
vyos-1x-2a023b878471500bd78962ca94d9174a328ce5c9.zip
RADIUS: T5577: Added `mandatory` and `optional` modes for RADIUS
In CLI we can choose authentication logic: - `mandatory` - if RADIUS answered with `Access-Reject`, authentication must be stopped and access denied immediately. - `optional` (default) - if RADIUS answers with `Access-Reject`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if RADIUS clearly answered that access should be denied (no user in RADIUS database, wrong password, etc.). If RADIUS is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode.
Diffstat (limited to 'interface-definitions')
-rw-r--r--interface-definitions/include/radius-server-ipv4-ipv6.xml.i20
1 files changed, 20 insertions, 0 deletions
diff --git a/interface-definitions/include/radius-server-ipv4-ipv6.xml.i b/interface-definitions/include/radius-server-ipv4-ipv6.xml.i
index ac0950ae8..e454b9025 100644
--- a/interface-definitions/include/radius-server-ipv4-ipv6.xml.i
+++ b/interface-definitions/include/radius-server-ipv4-ipv6.xml.i
@@ -26,6 +26,26 @@
</children>
</tagNode>
#include <include/source-address-ipv4-ipv6-multi.xml.i>
+ <leafNode name="security-mode">
+ <properties>
+ <help>Security mode for RADIUS authentication</help>
+ <completionHelp>
+ <list>mandatory optional</list>
+ </completionHelp>
+ <valueHelp>
+ <format>mandatory</format>
+ <description>Deny access immediately if RADIUS answers with Access-Reject</description>
+ </valueHelp>
+ <valueHelp>
+ <format>optional</format>
+ <description>Pass to the next authentication method if RADIUS answers with Access-Reject</description>
+ </valueHelp>
+ <constraint>
+ <regex>(mandatory|optional)</regex>
+ </constraint>
+ </properties>
+ <defaultValue>optional</defaultValue>
+ </leafNode>
</children>
</node>
<!-- include end -->