providers/radius: simple radius outpost

[BeryJu]

A simple radius outpost that only supports username/password authentication (using the same flow executor as the ldap outpost), no support for CHAP as that would require reversible password storage, no support for TLS as there are multiple ways to implement that but none are supported by the current go library

[netlify]

✔️ Deploy Preview for authentik ready!

🔨 Explore the source changes: 1ecb994

🔍 Inspect the deploy log: https://app.netlify.com/sites/authentik/deploys/619288d34f83ec0007a59ed9

😎 Browse the preview: https://deploy-preview-1796--authentik.netlify.app

[netlify]

✅ Deploy Preview for authentik ready!

Name	Link
🔨 Latest commit	173fae6
🔍 Latest deploy log	https://app.netlify.com/sites/authentik/deploys/64187f8a7f58d30008577cdd
😎 Deploy Preview	https://deploy-preview-1796--authentik.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[codecov]

Codecov Report

Patch coverage: 78.88% and project coverage change: -0.01 ⚠️

Comparison is base (84c2da8) 92.77% compared to head (02dde23) 92.75%.

❗ Current head 02dde23 differs from pull request most recent head 173fae6. Consider uploading reports for the commit 173fae6 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1796      +/-   ##
==========================================
- Coverage   92.77%   92.75%   -0.01%     
==========================================
  Files         501      505       +4     
  Lines       25617    25688      +71     
==========================================
+ Hits        23764    23825      +61     
- Misses       1853     1863      +10     

Flag	Coverage Δ
e2e	52.69% <74.65%> (-0.01%)	⬇️
integration	26.46% <28.17%> (+0.01%)	⬆️
unit	89.54% <78.88%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
authentik/providers/radius/controllers/docker.py	0.00% <0.00%> (ø)
...thentik/providers/radius/controllers/kubernetes.py	0.00% <0.00%> (ø)
authentik/root/settings.py	90.16% <ø> (ø)
authentik/providers/radius/models.py	95.66% <95.66%> (ø)
authentik/api/v3/urls.py	100.00% <100.00%> (ø)
authentik/outposts/api/outposts.py	86.75% <100.00%> (+0.17%)	⬆️
authentik/outposts/models.py	88.22% <100.00%> (+0.05%)	⬆️
authentik/providers/radius/api.py	100.00% <100.00%> (ø)

... and 5 files with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

[samip5]

Is that going to be both IPv6 and IPv4? or only IPv4?

[ferferga]

@BeryJu Care to explain why this has been closed? Was eagerly waiting for this :(

[BeryJu]

@BeryJu Care to explain why this has been closed? Was eagerly waiting for this :(

I was just renaming some branches for cleanup, I forgot that closes the PR for it too.

Also this probably wont happen for a while since all radius implementations that use anything but the very basic features require access to unhashed passwords somewhere wihch I dont want to save.

[jflattery]

@BeryJu Pardon my ignorance, but isn't that the point behind FreeRADIUS' radcrypt?

[MrSuicideParrot]

@BeryJu could you share with us what is the status of the Radius outpost? What are the plans of authentik regarding it?

I've spend a week trying to configure freeradius and authentik with the ldap outpost for a VPN with DUO, and realized that working with ldap is two limiting. Even though you are only implementing clear text passwords, I think that it would be better than having to rely on the ldap outpost.

[cwildfoerster]

Would love to see radius support too.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-outpost-radius-v2-1679327525-4fd4a97
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-outpost-radius-v2-1679327525-4fd4a97-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-outpost-radius-v2-1679327525-4fd4a97

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-outpost-radius-v2-1679327525-4fd4a97-arm64

Afterwards, run the upgrade commands from the latest release notes.