RADIUS Extension

The policies are applied to the servers with the NPS (Network Policy Server) role deployed and allow you to perform additional settings.

You can configure the policies either with domain group policies or with the local group policy on the NPS server. After configuring the policies, you must restart the NPS service.

Configure the Challenge\Response session timeout

Allows you to set the session timeout when using an authentication provider that supports Challenge\Response.

In registry

1. Open Registry Editor on the NPS server.

2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius section.

3. Create a parameter of the DWORD type named SessionLifetimeSec. As the value, specify the session timeout in seconds in the decimal format.

   Example

   Windows Registry Editor Version 5.00
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius]
   "SessionLifetimeSec"=dword:0000001e

In Group Policy Editor

1. Open Group Policy Editor.
2. Go to Computer Configuration→Administrative Templates→Axidian ID→Radius.
3. Open the Challenge\Response session timeout settings policy.
4. Enable the policy. In the Session timeout in seconds field, specify the required value.

Challenge\Response: message to the user

The policy allows you to set the message shown to the user when Challenge\Response is used.

In registry

1. Open Registry Editor on the NPS server.

2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius section.

3. Create a section with the name of the required provider: EmailOTP, HardwareHOTP, GoogleOTP, SMSOTP.

4. Create a string parameter with a name in the format <name of the provider used>ChallengeResponseReplyMessage, such as HardwareHOTPChallengeResponseReplyMessage.

5. As the value, specify the text that is displayed to the user.

   Example

   Windows Registry Editor Version 5.00
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius\EmailOTP]
   "EmailOTPChallengeResponseReplyMessage"="EmailOTP:"
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius\HardwareHOTP]
   "HardwareHOTPChallengeResponseReplyMessage"="HardwareHOTP: "
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius\GoogleOTP]
   "GoogleOTPChallengeResponseReplyMessage"="Software TOTP OTP: "
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius\SMSOTP]
   "SMSOTPChallengeResponseReplyMessage"="SMS OTP: "

In Group Policy Editor

1. Open Group Policy Editor.
2. Go to Computer Configuration→Administrative Templates→Axidian ID→Radius→<Name of the provider used>.
3. Open the Challenge\Response message to the user policy.
4. Enable the policy. In the Message to the user field, enter the required text.

Detect the RADIUS client IP address

The policy allows you to set the attributes for detecting the RADIUS client IP address that is used to search for the RADIUS application in Axidian Access. If no value is assigned, the default value corresponds to 265 (SrcIPAddress), 278 (SrcIPv6Address).

In registry

1. Open Registry Editor on the NPS server.

2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius section.

3. Create a parameter of the REG_SZ type named ClientIPAttributes and set the required value (you can specify several values separated by commas):

   • 4 — NASIPAddress
   • 95 — NASIPv6Address
   • 265 — SrcIPAddress
   • 278 — SrcIPv6Address

In Group Policy Editor

1. Open Group Policy Editor.
2. Go to Computer Configuration→Administrative Templates→Axidian ID→Radius.
3. Open the Detect the RADIUS client IP address policy.
4. Enable the policy. In the Attributes field, specify the required value. You can specify several values separated by commas.

User group caching

The policy enables user group caching during RADIUS authentication and allows you to set the cache update period.

Note

If NPS RADIUS Extension or Core Server respond slowly when working under load with a large number of users, you must disable this setting.

In registry

1. Open Registry Editor on the NPS server.

2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius section.

3. Create a parameter of the DWORD type named UserGroupsCachingEnabled and set the parameter value to 1.

4. Create a parameter of the DWORD type named UserGroupsCacheUpdateMin and set the parameter value to a decimal number in minutes.

   Example

   Windows Registry Editor Version 5.00
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius]
   "UserGroupsCachingEnabled"=dword:00000001
   "UserGroupsCacheUpdateMin"=dword:00000021

In Group Policy Editor

1. Open Group Policy Editor.
2. Go to Computer Configuration→Administrative Templates→Axidian ID→Radius.
3. Open the User group caching settings policy.
4. Enable the policy. In the User group update period in minutes field, specify the required value in minutes.

User name settings

The policy allows you to configure the use of the NetBIOS domain name when the username is specified without the domain.

In registry

1. Open Registry Editor on the NPS server.

2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius section.

3. Create a parameter of the DWORD type named UseNetBiosDomainName with the value 1.

   Example

   Windows Registry Editor Version 5.00
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius]
   "UseNetBiosDomainName"=dword:00000001

In Group Policy Editor

1. Open Group Policy Editor.
2. Go to Computer Configuration→Administrative Templates→Axidian ID→Radius.
3. Open the User name settings policy.
4. Enable the policy and activate the Use the NetBIOS domain name when the username is specified without the domain parameter.

User request session caching settings

The policy enables the caching of user request sessions during RADIUS authentication and allows you to set the request session lifetime in seconds.

In registry

1. Open Registry Editor on the NPS server.

2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius section.

3. Create a parameter of the DWORD type named RequestSessionCachingEnabled and set the parameter value to 1.

4. Create a parameter of the DWORD type named RequestSessionLifetimeSec and set the parameter value to a decimal number in seconds.

   Example

   Windows Registry Editor Version 5.00
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius]
   "RequestSessionCachingEnabled"=dword:00000001
   "RequestSessionLifetimeSec"=dword:0000003c

In Group Policy Editor

1. Open Group Policy Editor.
2. Go to Computer Configuration→Administrative Templates→Axidian ID→Radius.
3. Open the User request session caching settings policy.
4. Enable the policy. In the Request session lifetime in seconds field, specify the value.

Disable the use of the login method settings from Management Console

In Axidian Access 8.2 and higher, you can configure the login method in the Management Console application. In version 8.1 and earlier, the login method was configured with the Login method settings for user groups and Common login method settings policies.

You can use your existing login method settings in the current version of Axidian Access. To do this, configure the Disable the use of Axidian Access policies policy.

In registry

1. Open Registry Editor on the NPS server.

2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius section.

3. Create a parameter of the DWORD type named DisableAccessManagerPolicies and set the parameter value to 1.

In Group Policy Editor

1. Open Group Policy Editor.
2. Go to Computer Configuration→Administrative Templates→Axidian ID→Radius.
3. Open the Disable the use of Axidian Access policies policy.
4. Enable the policy.