Okta RADIUS Vendor-Specific Attributes Sent as String Instead of Decimal Values
Last Updated:
Overview
The Okta Remote Authentication Dial-In User Service (RADIUS) application natively sends Vendor-Specific Attributes (VSAs) as text strings, which causes integration issues with devices expecting decimal values. Because Okta does not support changing the attribute encoding to a numeric or binary value, the conversion must be handled outside of Okta. When configuring the Okta RADIUS app to integrate with devices such as a Radware Alteon, specific attributes that map to user permissions on the target device are required. Integration issues occur when the target device expects these attribute values to be formatted as decimal values, but Okta sends the information as characters. Creating Okta user groups named after the required decimal values does not resolve this encoding mismatch.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Remote Authentication Dial-In User Service (RADIUS)
- Multi-Factor Authentication (MFA)
Cause
The Okta RADIUS application natively supports sending group information and VSAs, but it only supports sending these values as text attributes. Currently, there is no supported configuration option within the Okta RADIUS app to change the attribute encoding from a string to a numeric or binary value in decimal representation.
Solution
How are Vendor-Specific Attributes configured in the Okta RADIUS application?
Because there is no native method to force the Okta RADIUS app to send attributes as decimal values, the conversion must be handled outside of Okta.
NOTE: While decimal encoding is not supported, standard string-based attributes are configured under the Advanced RADIUS Settings of the Okta RADIUS app.
Configure standard string-based attributes under the Advanced RADIUS Settings of the Okta RADIUS app by checking the group inclusion, setting the attribute type, specifying the IDs, and defining the group memberships.
- Select Include groups in RADIUS response.
- Set the RADIUS attribute to 26 - Vendor-Specific.
- Enter the required Vendor Specific ID and Attribute ID.
- Define the Group memberships to return.
