authentik.providers.radius.models

  1"""Radius Provider"""
  2
  3from collections.abc import Iterable
  4
  5from django.db import models
  6from django.templatetags.static import static
  7from django.utils.translation import gettext_lazy as _
  8from rest_framework.serializers import Serializer
  9
 10from authentik.core.models import PropertyMapping, Provider
 11from authentik.crypto.models import CertificateKeyPair
 12from authentik.lib.generators import generate_id
 13from authentik.outposts.models import OutpostModel
 14
 15
 16class RadiusProvider(OutpostModel, Provider):
 17    """Allow applications to authenticate against authentik's users using Radius."""
 18
 19    shared_secret = models.TextField(
 20        default=generate_id,
 21        help_text=_("Shared secret between clients and server to hash packets."),
 22    )
 23
 24    client_networks = models.TextField(
 25        default="0.0.0.0/0, ::/0",
 26        help_text=_(
 27            "List of CIDRs (comma-separated) that clients can connect from. A more specific "
 28            "CIDR will match before a looser one. Clients connecting from a non-specified CIDR "
 29            "will be dropped."
 30        ),
 31    )
 32
 33    mfa_support = models.BooleanField(
 34        default=True,
 35        verbose_name="MFA Support",
 36        help_text=_(
 37            "When enabled, code-based multi-factor authentication can be used by appending a "
 38            "semicolon and the TOTP code to the password. This should only be enabled if all "
 39            "users that will bind to this provider have a TOTP device configured, as otherwise "
 40            "a password may incorrectly be rejected if it contains a semicolon."
 41        ),
 42    )
 43
 44    certificate = models.ForeignKey(
 45        CertificateKeyPair, on_delete=models.CASCADE, default=None, null=True
 46    )
 47
 48    @property
 49    def launch_url(self) -> str | None:
 50        """Radius never has a launch URL"""
 51        return None
 52
 53    @property
 54    def component(self) -> str:
 55        return "ak-provider-radius-form"
 56
 57    @property
 58    def icon_url(self) -> str | None:
 59        return static("authentik/sources/radius.svg")
 60
 61    @property
 62    def serializer(self) -> type[Serializer]:
 63        from authentik.providers.radius.api.providers import RadiusProviderSerializer
 64
 65        return RadiusProviderSerializer
 66
 67    def get_required_objects(self) -> Iterable[models.Model | str | tuple[str, models.Model]]:
 68        required = [self, "authentik_stages_mtls.pass_outpost_certificate"]
 69        if self.certificate is not None:
 70            required.append(("authentik_crypto.view_certificatekeypair", self.certificate))
 71            required.append(
 72                ("authentik_crypto.view_certificatekeypair_certificate", self.certificate)
 73            )
 74            required.append(("authentik_crypto.view_certificatekeypair_key", self.certificate))
 75        return required
 76
 77    def __str__(self):
 78        return f"Radius Provider {self.name}"
 79
 80    class Meta:
 81        verbose_name = _("Radius Provider")
 82        verbose_name_plural = _("Radius Providers")
 83
 84
 85class RadiusProviderPropertyMapping(PropertyMapping):
 86    """Add additional attributes to Radius authentication responses."""
 87
 88    @property
 89    def component(self) -> str:
 90        return "ak-property-mapping-provider-radius-form"
 91
 92    @property
 93    def serializer(self) -> type[Serializer]:
 94        from authentik.providers.radius.api.property_mappings import (
 95            RadiusProviderPropertyMappingSerializer,
 96        )
 97
 98        return RadiusProviderPropertyMappingSerializer
 99
100    def __str__(self):
101        return f"Radius Provider Property Mapping {self.name}"
102
103    class Meta:
104        verbose_name = _("Radius Provider Property Mapping")
105        verbose_name_plural = _("Radius Provider Property Mappings")