On a UNIX or Windows server, a RADIUS Server is a background process that operates. It enables you to keep track of user profiles in a main database. As a result, if you have a RADIUS Server, you can decide who can access your network. NetIQ Privileged Access Manager also supports a variety of MFA products such as RADIUS protocol support, including Duo, RSA, Gemalto, and Yubico.The RADIUS Client makes requests to the RADIUS Server whenever a user tries to connect to it. Only once the RADIUS Server authenticates and approves the user can establish a connection to the RADIUS Client.You must specify the details of the Remote Authentication Dial-In User Service (RADIUS) server in Privileged Access Manager to authenticate users with a third-party RADIUS server.
Prerequisite
On Linux, publish and install the radiusagnt package to enable the RADIUS Server configuration.
NOTE:The radiusagnt package cannot be installed on a Windows manager. If you have a Windows-only Privileged Access Manager environment, you must add a backup Privileged Access Manager Linux manager to the deployment.
If Advanced Authentication is configured and you want to configure Privileged Access Manager for RADIUS, ensure that you delete Advanced Authentication configuration from Options page.
Configuring a RADIUS Server
To configure the RADIUS server details, perform the following:
On the Home page of the Administration Console, click Settings.
Click External Services > RADIUS Server.
In the right pane, specify the RADIUS Server Configuration details:
Hostname/IP Address and Port Number: Specify the hostname or IP address of the RADIUS and the port where the RADIUS authentication request is sent. The default port is 1812. server.
Secret: Specify the shared secret between the RADIUS server and Privileged Access Manager where RADIUS Agent is installed.
Timeout: Specify the duration (in seconds) for which the RADIUS client should wait for the RADIUS server to reply. The default value is 15 seconds.
Retry count: Specify the number of times the RADIUS client should try to connect to the RADIUS server. The default value is set to 3. If set to 0, the RADIUS client does not try to connect after the first unsuccessful attempt.
Retrieve authorization attributes from LDAP server: Move the slider to left if you want to disable this option. Setting this to enable, retrieves authorization attributes from the LDAP server.
Add the RADIUS Dictionary Attributes.
For example, "NAS ID" attribute is named "NAS-Identifier" in the RADIUS Dictionary.
For more information, see the FreeRADIUS 'man' pages and the FreeRADIUS dictionary.
NOTE:
You can modify the RADIUS Dictionary Attributes using the Manage Attributes option.
RADIUS authentication functionality is available for logins but not for command control policy based authorization.