RADIUS Provider

You can configure a Radius provider for applications that don't support any other protocols or that require Radius.

info

This provider requires the deployment of a RADIUS outpost.

Currently, only authentication requests are supported.

Authentication flow

Authentication requests against the Radius Server use a flow in the background. This allows you to use the same flows, stages, and policies as you do for web-based logins.

The following stages are supported:

• Identification
• Password
• Authenticator validation

info

Authenticator validation currently only supports DUO, TOTP, and static authenticator.

For code-based authenticators, the code must be given as part of the bind password, separated by a semicolon. For example for the password example-password and the MFA token 123456, the input must be example-password;123456.

SMS-based authenticators are not supported because they require a code to be sent from authentik, which is not possible during the bind.

• User Logout
• User Login
• Deny
• Mutual TLS stage

Protocol support

The RADIUS provider supports EAP-TLS and PAP (Password Authentication Protocol) protocol. For password-based authentication, only PAP protocol is supported due to other password hashing methods requiring reversible password hashes, which we don’t support for security reasons.

RADIUS compatibility matrix for password-based authentication:

This table represents the password-hash compatibillity with various RADIUS protocols.

	Cleartext	NT	MD5	Salted MD5	SHA1	Salted SHA1	Unix Crypt
PAP	✓	✓	✓	✓	✓	✓	✓
CHAP	✓	✗	✗	✗	✗	✗	✗
Digest	✓	✗	✗	✗	✗	✗	✗
MS-CHAP	✓	✓	✗	✗	✗	✗	✗
PEAP	✓	✓	✗	✗	✗	✗	✗
MS-CHAPv2	✓	✓	✗	✗	✗	✗	✗
Cisco LEAP	✓	✓	✗	✗	✗	✗	✗
EAP-GTC	✓	✓	✓	✓	✓	✓	✓
EAP-MD5	✓	✗	✗	✗	✗	✗	✗
EAP-PWD	✓	✗	✗	✗	✗	✓	✓

EAP Enterprise authentik: 2025.10.0+

authentik supports EAP with TLS as the inner protocol, between the application and transport layers to encrypt and secure communications. To set this up, a certificate authority needs to be available and client certificates need to be installed on machines, the configuration of which is outside of the scope of this document.

EAP-TLS

Create an authentication flow with a Mutual TLS stage as its first stage. This stage should be configured to use your CA's certificate. Afterwards a server certificate needs to be selected in the RADIUS provider (which serves as an outpost). Then, configure your RADIUS provider to use this authentication flow to enable EAP-TLS authentication. After the certificate and the authentication flow are configured in the provider, authentication via EAP-TLS is possible.

For certificates, ensure that you use a client certificate and a server certificate that are created by a certificate authority, not a self-generated certificate.

Use of trusted Certificate Authority

For EAP-TLS, note that you should NOT use a globally known CA.

Using private PKI certificates that are trusted by the end-device is best practise. For example, using a Verisign certificate as a "known CA" means that ANYONE who has a certificate signed by them can authenticate via EAP-TLS, and in addition you should implement custom validation to prevent unauthorized access.

RADIUS attributes

Starting with authentik 2024.8, you can create RADIUS provider property mappings, which make it possible to add custom attributes to the RADIUS response packets.

For example, to add the Cisco AV-Pair attribute, this snippet can be used:

define_attribute(
    vendor_code=9,
    vendor_name="Cisco",
    attribute_name="AV-Pair",
    attribute_code=1,
    attribute_type="string",
)
packet["Cisco-AV-Pair"] = "shell:priv-lvl=15"
return packet

After creation, make sure to select the RADIUS property mapping in the RADIUS provider.