> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/6/configure/auth/radius/configure-radius-authentication/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Configure RADIUS authentication

> Step-by-step procedure to configure RADIUS-based authentication in Itential Platform, including FreeRADIUS setup, adapter configuration, and profile creation.

The RADIUS adapter allows Itential Platform to interact with a RADIUS server for authentication. Use this procedure to configure RADIUS-based authentication.

## Before you begin

The RADIUS server must include a vendor-specific attribute (VSA), typically placed in the dictionary file. The syntax provided in [Configure FreeRADIUS files](#configure-freeradius-files) corresponds with this guide and applies to FreeRADIUS. The syntax for other RADIUS servers may differ — refer to your RADIUS server's documentation for the exact syntax required. You must also ensure users and groups are correctly configured with the `Itential-Group` VSA attribute.

## Install FreeRADIUS

The following steps provide a basic installation process using FreeRADIUS as an example. IPs, usernames, groups, and passwords will vary with your environment. This sample installation was performed on a CentOS 7 virtual machine in a test environment.

#### Install FreeRADIUS

```bash
sudo yum -y install freeradius freeradius-utils freeradius-mysql freeradius-perl
```

#### Start, enable, and check the service

```bash
systemctl start radiusd.service
systemctl enable radiusd.service
systemctl status radiusd.service
```

The status command should show as active (running).

![](/_fern-img/fce5b0ca3e48cf9ef6517a290ce8aa0b1843f6e7d863e9170a63dfdd294c5922.webp)

#### Open required ports

Open ports `1812` and `1813` for both UDP and TCP. The example below uses the `firewall` command.

![](/_fern-img/4e8d900b6c981d8685609f6fe05018ed25d3390b3c37f6b55c3210abe6459217.webp)

## Configure FreeRADIUS files

These instructions are provided as an example — your environment will differ.

A vendor-specific attribute (VSA) is required when using FreeRADIUS. Add the VSA information to the dictionary and users files. The RADIUS configuration file at `/usr/lib/firewalld/services/radius.xml` will most likely not require changes.

#### Add the VSA to the dictionary file

Open `/etc/raddb/dictionary` in your preferred editor and add the following lines. You may add them to the end of the file.

```
# itential
VENDOR Itential 47688
BEGIN-VENDOR Itential
ATTRIBUTE Itential-Group 26 string
END-VENDOR Itential
```

#### Add users to the users file

Open `/etc/raddb/users` and add the following:

```
testing Cleartext-Password := "password"
    Itential-Group = "admin"

admin Cleartext-Password := "admin"
    Itential-Group = "pronghorn_admin"
```

#### Update the clients configuration

Open `/etc/raddb/clients.conf`. Adjust the `localhost` client information to reflect the actual IP address for your production environment. The example shown does not need to be changed for a test environment.

![](/_fern-img/34527c6970a0dc63014cc2d0f79c98303a67804364adcf09b8f9770d048fc4bf.webp)

## Test FreeRADIUS

#### Stop FreeRADIUS and start in debug mode

```bash
radiusd -X
```

#### Run a test authentication command

Open a second terminal window and run the following command:

```bash
radtest admin admin 127.0.0.1 0 testing123
```

## Add a RADIUS adapter

#### Open Admin Essentials

After logging in to Itential Platform, select **Admin Essentials** in the left navigation menu.

#### Create a new adapter

Click the **plus sign** in the top toolbar to create a new adapter. The **Create** dialog opens. Click the dropdown arrow and select **Adapter** from the menu list.

#### Enter adapter information

Enter a name for the adapter (for example, `Local_RADIUS`) and select the RADIUS adapter type from the dropdown menu.

![](/_fern-img/6adbb567bd3fa08579456f568d549ee463ed38d54578a0db35a7f803a3481a04.webp)

#### Create the adapter

Click **Create**. The adapter appears in the **Adapters** collection menu on the left and the **Configuration** tab displays automatically.

#### Open the Service Config editor

Click the **Advanced View** toggle in the upper-right to display the **Service Config** editor and check the adapter's configuration.

![](/_fern-img/6b2005ed2af4da619c46b40abe70724a72c0c1085aa9d5e2b08944d628056ac5.webp)

#### Verify the brokers property

Check for `aaa` (authentication, authorization, and accounting) in the `brokers` property field. If the field is empty, add the broker.

![](/_fern-img/e5b142d9f95e9baa74b9c3d7bac5198411287c9b0118c5554263e51d80c85c30.webp)

## Configure local RADIUS parameters

The configuration below shows the default parameters. You must include the correct groups that will be allowed to access Itential Platform — at a minimum, include the group that will have administrative rights. If a login user and their associated group are not listed, they will not have access to any adapters or apps within Itential Platform.

If you use a name other than `Local_Radius`, update the `"id"` property along with the `"name"` and `"group"` properties under `"radius_groups"`.

```json
{
  "name": "Local_Radius",
  "model": "@itential/adapter-radius",
  "type": "Adapter",
  "properties": {
    "id": "Local_Radius",
    "type": "RADIUS",
    "properties": {
      "host": "11.11.1.11",
      "port": 1812,
      "secret": "password",
      "radius_groups": [
        {
          "name": "admin",
          "group": "admin"
        },
        {
          "name": "pronghorn_admin_radius",
          "group": "pronghorn_admin_radius"
        }
      ],
      "healthcheck": {
        "type": "startup",
        "frequency": 6000
      }
    },
    "brokers": [
      "aaa"
    ],
    "groups": []
  },
  "isEncrypted": true,
  "redisProps": {
    "host": "127.0.0.1",
    "port": 6379
  },
  "loggerProps": {
    "description": "Logging",
    "log_max_files": 100,
    "log_max_file_size": 1048576,
    "log_level": "spam",
    "log_directory": "/var/log/pronghorn",
    "log_filename": "RADIUS.log",
    "console_level": "warn"
  }
}
```

## Create a profile for the RADIUS adapter

#### Clone an existing profile

Select an existing profile (usually `profile1`) from the **Profiles** collection in the left navbar. Click the stacked dots icon in the upper-right and select **Clone** from the menu options.

![](/_fern-img/cc38af46c4d4873e72c973dc3cb130696712c2ce90e3463d7043ee2ef8de9fba.webp)

#### Name the new profile

Enter a name for the new profile (for example, `RADIUS`) and click **Clone**. The profile appears in the **Profiles** collection on the left and the **Configure** editor displays.

![](/_fern-img/f4f187cc86ec96a4d57843ff23fff47d081fd18f1e5d586e597c2ce979a67ed7.webp)

#### Edit the profile

Edit the **Profile Services** and **Profile Properties** as needed. Click **Save** to keep your changes.

![](/_fern-img/7d6e145c3c452354af46ae26c6f43e028537319436edf346328e76611aa221c3.webp)

#### Activate the profile

Restart theItential Platform service to activate the RADIUS profile. Authorization levels will also need to be set to provide admin group access.

```bash
service pronghorn restart
```

To encrypt the secret under the adapter properties, refer to [Password Encryption](/itential-platform/6/auth/aaa/configure-local-aaa-authentication#encrypt-passwords).

## Troubleshoot the RADIUS adapter

If you encounter issues using the RADIUS adapter:

1. If you cannot access Itential Platform using the RADIUS profile, revert to the original profile. From a terminal prompt, use root login to edit `/opt/pronghorn/current/properties.json` and set the active profile to `profile1`:

   ```json
   {
     "pathProps": {
       "description": "File Path Variables",
       "sdk_dir": "/opt/pronghorn-applications",
       "encrypted": true
     },
     "id": "profile1",
     "mongoProps": {
       "credentials": {
         "passwd": "itentialPassword",
         "user": "itentialUser"
       },
       "db": "pronghorn",
       "url": "mongodb://127.0.0.1:27017"
     }
   }
   ```

2. Restart the Itential Platform service and attempt to log in again:

   ```bash
   service pronghorn restart
   ```

3. If problems persist, the issue is usually related to configuration. Check the following:

   **RADIUS adapter:**

   * Check the RADIUS hostname and port.
   * Check how groups are configured.
   * From a server prompt, stop and restart the associated process for the adapter using the `kill` command and the PID for the RADIUS adapter.

   **RADIUS server:**

   * Check the whitelist file to ensure the Itential Platform server address is listed. With FreeRADIUS, check `/etc/raddb/clients.conf`.
   * Check the users file to confirm the Itential Platform user is correctly defined with the correct username, password, and group in `/etc/raddb/users`.
   * Verify the VSA is defined correctly in `/etc/raddb/dictionary`.
   * Check firewall and ACL rules.

See the [FreeRADIUS documentation](https://freeradius.org/documentation/) for further instructions on installation, configuration, and troubleshooting.

> Step-by-step procedure to configure RADIUS-based authentication in Itential Platform, including FreeRADIUS setup, adapter configuration, and profile creation.