
###################################################################################
#                                                                                 #
# Configuration for RADIUS-Based Authentication to the Administrative Console/API #
#                                                                                 #
###################################################################################

#
# The RADIUS protocol relies on the MD5 hash algorithm, which is not FIPS-approved.
# Therefore RADIUS authentication is not recommended in environments where FIPS
# compliance is required.
#

# *****************************************************************************
#                         Basic Connection Properties
# *****************************************************************************

# =====================================
# Required Attributes
# =====================================

# The following are all required attributes:
#
# - RADIUS server address (host)
# - RADIUS shared secret (shared.secret)


# -------------------------------------
# RADIUS server address (REQUIRED)
# -------------------------------------

# Host name or IP address of the RADIUS server.
#
# For failover configuration, you may supply multiple values in the following
# property, separated by a space.  PingFederate will attempt to make a
# connection to each server in the order listed until a successful connection
# is obtained.  Please note that if multiple servers are specified, they must
# all use the same shared secret and authentication port.
#
host=

#   -------------------------------------
#   RADIUS shared secret (REQUIRED)
#   -------------------------------------
#   This is password shared with the RADIUS server used to encrypt passwords.
#   This property should be obfuscated using one of the following utilities:
#
#   On Windows:
#     >obfuscate.bat <password>
#
#   On Linux: 
#     >./obfuscate.sh <password>
#
#   Example: 
#     obfuscate.bat secret
#       Result:
#       OBF:JWE:eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2Iiwia2lkIjoiVEU0dVZjcU1wayIsInZlcnNpb24iOiI3LjEuMjAwLjQtU05BUFNIT1QifQ..8Zf_xQ4PuXuYkdE0culPpA.E2Lh_zAne5YpaJo9wbl39A.Z8wVd6SFB8lcQbvutU1u-Q
#   Copy complete result into property value, as shown in the example below:
#     shared.secret=OBF:JWE:eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2Iiwia2lkIjoiVEU0dVZjcU1wayIsInZlcnNpb24iOiI3LjEuMjAwLjQtU05BUFNIT1QifQ..8Zf_xQ4PuXuYkdE0culPpA.E2Lh_zAne5YpaJo9wbl39A.Z8wVd6SFB8lcQbvutU1u-Q
#
shared.secret=

# -------------------------------------
# Authentication port
# -------------------------------------

# This is the port used to authenticate to the RADIUS server. The default value
# is 1812 if unspecified.
#
authentication.port=1812

# -------------------------------------
# Timeout
# -------------------------------------

# The maximum number of milliseconds before a connection timeout to the RADIUS server.
#
timeout=3000

# -------------------------------------
# Authentication protocol
# -------------------------------------

# This is the protocol used to authenticate to the RADIUS server.
#   Valid values are:
#     PAP - Password Authentication Protocol.
#     CHAP   - Challenge Handshake Authentication Protocol.
# Default is PAP.
#
authentication.protocol=PAP

# -------------------------------------
# NAS-Identifier
# -------------------------------------

# This identifier is used in Access-Request packets for the NAS-Identifier
# attribute. The default value is "PingFederate" if unspecified.
#
nas.identifier=PingFederate


# *****************************************************************************
#                         Assignment of Permissions
# *****************************************************************************

# There are three ways that role assignments (and the permissions associated
# with those roles) may be managed:
# 1) Using LDAP. In this mode, the role mapping is done using roles defined by
#    an LDAP server.
# 2) Based solely on an explicit mapping between PingFederate roles and
#    individual user accounts.
# 3) Based on a mapping between PingFederate roles and a RADIUS response
#    attribute value.
#
# Notes:
# - At least one of the above methods must be used.
# - When method 1 is used, methods 2 and 3 are ignored.
# - Methods 2 and 3 can be used at the same time and results will be combined.
# - The PingFederate auditor role supersedes all other roles. If a
#   user is assigned multiple roles (regardless of the mechanism used) and one
#   of those roles is auditor, the user will retain only those privileges that
#   are associated with the auditor role.


# =====================================
# 1) LDAP-Based Permissions
# =====================================

#
# Setting this value to true delegates the role assignment to LDAP. Once the
# user is authenticated successfully to the RADIUS server, the user's roles are
# retrieved from an LDAP server. The file used to configure LDAP is the same
# used by the LDAP authentication mechanism and is defined by the property
# "ldap.properties.file" in run.properties (e.g. ldap.properties).
#
# The default value is false if unspecified.
#
use.ldap.roles=false


# =====================================
# 2) RADIUS User-Based Permissions
# =====================================

# -------------------------------------
# Role Mapping
# -------------------------------------

# In this mode, you assign RADIUS user accounts directly to PingFederate
# administrative roles to specify who has access and what permissions they
# have. For more information on PingFederate roles, see the PingFederate
# Administrator's Manual).
#
# Any special characters in the value that needs to be evaluated must be
# escaped (e.g., "\ " for " ").  This is also true for spaces that occur at the
# beginning of the string.  See the javadoc for the load method for the
# java.util.Properties class for a definitive description of what characters
# need to be escaped and how escaping should occur.
#
# If multiple users are assigned to a single role, each subsequent user must
# be separated from the preceding user by a comma (i.e., comma-separated
# values).
#
#
#   Example:
#     role.admin=user1, user2
#     role.cryptoManager=user2
#     role.auditor=user3
#     role.userAdmin=user1
#     role.expressionAdmin=user1
#   In this example, user1 will have permissions associated with the "admin" and "userAdmin"
#   roles, and user2 will have permissions associated with both the "admin" role
#   role and the "cryptoManager" role, while user3 will have permissions
#   associated only with the "auditor" role. (Note: the auditor role overrides
#   the privileges associated with assignment of any other role for the same
#   user.)
#
role.admin=
role.cryptoManager=
role.auditor=
role.userAdmin=

# The expressionAdmin role must only be granted to the administrators with admin role.
role.expressionAdmin=


# =====================================
# 3) RADIUS Group-Based Permissions
# =====================================

# -------------------------------------
# RADIUS Role Attribute Code
# -------------------------------------

# This property is the RADIUS attribute code used to perform role mapping 
# as specified below. The default value is 11 (Filter-Id) if unspecified.
#
# NOTE: Each of the RADIUS role attributes that are returned in the
# Access-Accept need to be defined in the Role Mapping below.
#
role.attribute.code=11

# -------------------------------------
# Role Mapping
# -------------------------------------

# This set of properties maps the RADIUS membership information to the
# associated role(s) and permissions defined within PingFederate.
#
# Any special characters in the value that needs to be evaluated must be
# escaped (e.g., "\ " for " ").  This is also true for spaces that occur at the
# beginning of the string.  See the Javadoc for the load method for the
# java.util.Properties class for a definitive description of what characters
# need to be escaped and how escaping should occur.
#
# Only one value can be entered per line. If multiple RADIUS groups map to one
# PingFederate role, then multiple properties must be created using a numeric,
# incremental suffix, starting with 1. For example:
#   role.map.admin.1=
#   role.map.admin.2=
#   role.map.admin.3=
#
#   Example Mapping:
#     role.map.admin=group1
#     role.map.cryptoManager=group2
#     role.map.auditor=group3
#     role.map.userAdmin=group4
#     role.map.expressionAdmin=group1
#
role.map.admin=
role.map.cryptoManager=
role.map.auditor=
role.map.userAdmin=

# The expressionAdmin role must only be granted to the administrators with admin role.
role.map.expressionAdmin=