Realm user-name attribute

Edit online

Authentication and accounting packets are routed through the realm is based on the User-Name attribute. This attribute defines the order of realms the packet goes through in order to route it to the final server that does the authentication or accounting.

Packets are routed by stringing realms together in the User-Name attribute. The actual realms that are inserted into the User-Name attribute, which ultimately determines the path of the packet, is a decision left up to the administrator deploying the RADIUS layout. It is possible to put the names of the realm hops in front of the User-Name attribute, as well as behind it. The most popular characters to delineate the different realms are the slash (/) as the prefix delineator in front of the User-Name attribute, and ampersand (&) as the suffix delineator behind the User-Name attribute. Delineators are configured in the radiusd.conf file. The User-Name attribute is parsed from left to right.

An example of a User-Name attribute using only the prefix method is the following:

 USA/TEXAS/AUSTIN/joe

An example of a User-Name attribute using only the suffix method is the following:

joe@USA@TEXAS@AUSTIN

It is possible to use both prefix and suffix methods. It is important to remember when specifying the realm hops a packet will go through that the order of hops is parsed left to right, and all prefix hops are processed before processing suffix hops. The user must be authenticated, or the accounting data written, at a single node.

The following example, using both methods, yields the same result as the previous examples:

USA/joe@TEXAS@AUSTIN