{"Entry":{"collection":"auth","key":"radius","name":"radius","aliases":[],"metadata":{"aliases":[],"category":"Authentication and access control","content_hash":"5cc4b8389a7a6af91c11f643a942a97c92f95656c2a88a4443b205854c0b3bbb","derived_content_hash":"357c7a00c49659edcbc35ac7c4da4a982345386b5b0dce1b03c2e6af416ce2b8","imported_at":"2026-09-30T00:40:33.336913+08:00","name":"radius","name_zh":"","slug":"radius","summary":"Authenticate using a RADIUS server. See Section 20.11 for details."}},"Definition":{"Collection":"auth","Key":"radius","SourceDatabase":"center","Version":"18","SourceTable":"authentication_method","SourceKey":"radius","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","Facts":{"aliases":[],"attributes":{"configuration":"pg_hba.conf","inventory":"User-visible source authentication method","method":"radius"},"comparison_data":{"documented_option_names":["radiusidentifiers","radiusports","radiussecrets","radiusservers"],"method":"radius"},"comparison_hash":"084932634de939bfac07ac9c692a7d4dd0c6593c73dd494f2f0ccbad15d6f1a4","description":["Authenticate using a RADIUS server. See Section 20.11 for details."],"description_zh":"认证方法 radius。","description_zh_html":"\u003cp\u003e认证方法 radius。\u003c/p\u003e\u003cdl\u003e\u003cdt\u003e索引访问方法\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003eradius\u003c/code\u003e\u003c/dd\u003e\u003cdt\u003e配置\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003epg_hba.conf\u003c/code\u003e\u003c/dd\u003e\u003c/dl\u003e\u003ch3\u003e同版本中文手册节选\u003c/h3\u003e\u003cp\u003e\n    这种认证方法的工作方式与 \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e 类似，只不过它使用 RADIUS 作为密码验证方式。RADIUS 只用于验证用户名/密码对。因此，在使用 RADIUS 进行认证之前，用户必须已经存在于数据库中。\n   \u003c/p\u003e\u003cp\u003e\n    使用 RADIUS 认证时，会向配置好的 RADIUS 服务器发送一条 Access Request 消息。该请求的类型为 \u003ccode class=\"literal\"\u003eAuthenticate Only\u003c/code\u003e，并包含 \u003ccode class=\"literal\"\u003euser name\u003c/code\u003e、\u003ccode class=\"literal\"\u003epassword\u003c/code\u003e（加密的）以及 \u003ccode class=\"literal\"\u003eNAS Identifier\u003c/code\u003e 参数。该请求会使用与服务器共享的密钥进行加密。RADIUS 服务器会返回 \u003ccode class=\"literal\"\u003eAccess Accept\u003c/code\u003e 或 \u003ccode class=\"literal\"\u003eAccess Reject\u003c/code\u003e 作为响应。PostgreSQL 不支持 RADIUS 记账。\n   \u003c/p\u003e\u003cp\u003e\n    可以指定多个 RADIUS 服务器，这种情况下会按顺序依次尝试。如果某台服务器返回否定响应，则认证失败；如果没有收到响应，则继续尝试列表中的下一台服务器。要指定多台服务器，可用双引号括起整个列表，并用逗号分隔服务器名称。如果指定了多台服务器，其他 RADIUS 选项也可以写成逗号分隔的列表，以便为每台服务器分别提供不同取值；也可以只指定单个值，此时该值会应用到所有服务器。\n   \u003c/p\u003e\u003cp\u003e\n    RADIUS 支持下列配置选项：\n     \u003c/p\u003e\u003cp\u003e\u003ca href=\"/zh/docs/18/auth-radius.html\"\u003e查看完整中文手册与上下文\u003c/a\u003e。\u003c/p\u003e","facts":[{"label":"Method","value":"radius"},{"label":"Configuration","value":"pg_hba.conf"},{"label":"Inventory","value":"User-visible source authentication method"}],"facts_zh":[{"label":"方法","value":"radius"},{"label":"配置","value":"pg_hba.conf"},{"label":"清单","value":"用户可见的源码认证方法"}],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-RADIUS\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.11. RADIUS Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e except that it uses RADIUS as the password verification method. RADIUS is used only to validate the user name/password pairs. Therefore the user must already exist in the database before RADIUS can be used for authentication.\u003c/p\u003e\n\u003cp\u003eWhen using RADIUS authentication, an Access Request message will be sent to the configured RADIUS server. This request will be of type \u003ccode class=\"literal\"\u003eAuthenticate Only\u003c/code\u003e, and include parameters for \u003ccode class=\"literal\"\u003euser name\u003c/code\u003e, \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e (encrypted) and \u003ccode class=\"literal\"\u003eNAS Identifier\u003c/code\u003e. The request will be encrypted using a secret shared with the server. The RADIUS server will respond to this request with either \u003ccode class=\"literal\"\u003eAccess Accept\u003c/code\u003e or \u003ccode class=\"literal\"\u003eAccess Reject\u003c/code\u003e. There is no support for RADIUS accounting.\u003c/p\u003e\n\u003cp\u003eMultiple RADIUS servers can be specified, in which case they will be tried sequentially. If a negative response is received from a server, the authentication will fail. If no response is received, the next server in the list will be tried. To specify multiple servers, separate the server names with commas and surround the list with double quotes. If multiple servers are specified, the other RADIUS options can also be given as comma-separated lists, to provide individual values for each server. They can also be specified as a single value, in which case that value will apply to all servers.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for RADIUS:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eradiusservers\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe DNS names or IP addresses of the RADIUS servers to connect to. This parameter is required.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eradiussecrets\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe shared secrets used when talking securely to the RADIUS servers. This must have exactly the same value on the PostgreSQL and RADIUS servers. It is recommended that this be a string of at least 16 characters. This parameter is required.\u003c/p\u003e\n\u003cdiv class=\"note\"\u003e\n\u003ch3 class=\"title\"\u003eNote\u003c/h3\u003e\n\u003cp\u003eThe encryption vector used will only be cryptographically strong if \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e is built with support for \u003cspan class=\"productname\"\u003eOpenSSL\u003c/span\u003e. In other cases, the transmission to the RADIUS server should only be considered obfuscated, not secured, and external security measures should be applied if necessary.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eradiusports\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe port numbers to connect to on the RADIUS servers. If no port is specified, the default RADIUS port (\u003ccode class=\"literal\"\u003e1812\u003c/code\u003e) will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eradiusidentifiers\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe strings to be used as \u003ccode class=\"literal\"\u003eNAS Identifier\u003c/code\u003e in the RADIUS requests. This parameter can be used, for example, to identify which database cluster the user is attempting to connect to, which can be useful for policy matching on the RADIUS server. If no identifier is specified, the default \u003ccode class=\"literal\"\u003epostgresql\u003c/code\u003e will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIf it is necessary to have a comma or whitespace in a RADIUS parameter value, that can be done by putting double quotes around the value, but it is tedious because two layers of double-quoting are now required. An example of putting whitespace into RADIUS secret strings is:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... radius radiusservers=\"server1,server2\" radiussecrets=\"\"\"secret one\"\",\"\"secret two\"\"\"\n\u003c/pre\u003e\n\u003c/div\u003e","manual_path":"/docs/18/auth-radius.html","related":[],"release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sections":[],"sections_zh":[],"signature":"","sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-radius.html","sha256":"adc663bf8e300c937cc9ee1b2004b31455391ad8d8699f75abe1f643cc7ff39b","url":"/docs/18/auth-radius.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"The DNS names or IP addresses of the RADIUS servers to connect to. This parameter is required.","name":"radiusservers"},{"description":"The shared secrets used when talking securely to the RADIUS servers. This must have exactly the same value on the PostgreSQL and RADIUS servers. It is recommended that this be a string of at least 16 characters. This parameter is required. Note The encryption vector used will only be cryptographically strong if PostgreSQL is built with support for OpenSSL . In other cases, the transmission to the RADIUS server should only be considered obfuscated, not secured, and external security measures should be applied if necessary.","name":"radiussecrets"},{"description":"The port numbers to connect to on the RADIUS servers. If no port is specified, the default RADIUS port ( 1812 ) will be used.","name":"radiusports"},{"description":"The strings to be used as NAS Identifier in the RADIUS requests. This parameter can be used, for example, to identify which database cluster the user is attempting to connect to, which can be useful for policy matching on the RADIUS server. If no identifier is specified, the default postgresql will be used.","name":"radiusidentifiers"}],"title":"Documented method options and alternatives"}],"tables_zh":[{"columns":[{"key":"name","label":"选项或术语"},{"key":"description","label":"含义"}],"key":"method-options","rows":[{"description":"要连接的 RADIUS 服务器的 DNS 名称或 IP 地址。此参数为必需项。","name":"radiusservers"},{"description":"与 RADIUS 服务器进行安全通信时使用的共享密钥。它在 PostgreSQL 服务器和 RADIUS 服务器上必须完全相同。建议它至少是一个 16 个字符长的字符串。此参数为必需项。 注意 只有当 PostgreSQL 在构建时启用了 OpenSSL 支持，所使用的加密向量才具有足够的密码学强度。在其他情况下，到 RADIUS 服务器的传输只能被视为经过混淆，而非受到安全保护；如有必要，应额外采取外部安全措施。","name":"radiussecrets"},{"description":"要连接的 RADIUS 服务器端口号。如果未指定端口，则会使用默认的 RADIUS 端口 1812 。","name":"radiusports"},{"description":"在 RADIUS 请求中用作 NAS Identifier 的字符串。举例来说，这个参数可用于标识用户正在尝试连接哪个数据库集簇，从而便于在 RADIUS 服务器上进行策略匹配。如果未指定标识符，则默认使用 postgresql 。","name":"radiusidentifiers"}],"title":"手册中的方法选项与替代方式"}],"zh_from":{"authored_translation":"source-derived-structured-summary","body_sha256":"38748bc75eebad2bab22db233cdbfdf4a9524bfad00d6a696f902537809260cd","kind":"same-version-chinese-manual-with-source-derived-structured-summary","manual":{"anchor":"","build_id":107,"extraction":"concept-introduction","fragment_sha256":"165ed7f64919cb6effbd16ebf7a82a29d7f812fb1306d43a182118c48017b5b5","locale":"zh-Hans","page_key":"auth-radius.html","source_hash":"e1d8dd45563d595260941ba115fd75a11f3d99ae5325fd0561a7ec2f3a11691f","source_revision":"unknown:rendered-translation-baseline","translated_from_revision":null,"translation_revision":"git:b1b500221dbe5437cfca004d6b04d3f6e422765d;html-sha256:08e987a66af27b98444a8057c256314eafa13611a3fb9e888214fc436824244b","url":"/zh/docs/18/auth-radius.html","version":"18"},"runtime_rerun":false,"source_facts_revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}},"ManualEvidence":{"manual_path":"/docs/18/auth-radius.html","release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-radius.html","sha256":"adc663bf8e300c937cc9ee1b2004b31455391ad8d8699f75abe1f643cc7ff39b","url":"/docs/18/auth-radius.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}]},"MeasuredEvidence":{}},"Text":{"Collection":"auth","Key":"radius","SourceDatabase":"center","Version":"18","Locale":"en","Title":"radius","Summary":"Authenticate using a RADIUS server. See Section 20.11 for details.","BodyHTML":"\u003cdiv id=\"AUTH-RADIUS\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2\u003e20.11. RADIUS Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode\u003epassword\u003c/code\u003e except that it uses RADIUS as the password verification method. RADIUS is used only to validate the user name/password pairs. Therefore the user must already exist in the database before RADIUS can be used for authentication.\u003c/p\u003e\n\u003cp\u003eWhen using RADIUS authentication, an Access Request message will be sent to the configured RADIUS server. This request will be of type \u003ccode\u003eAuthenticate Only\u003c/code\u003e, and include parameters for \u003ccode\u003euser name\u003c/code\u003e, \u003ccode\u003epassword\u003c/code\u003e (encrypted) and \u003ccode\u003eNAS Identifier\u003c/code\u003e. The request will be encrypted using a secret shared with the server. The RADIUS server will respond to this request with either \u003ccode\u003eAccess Accept\u003c/code\u003e or \u003ccode\u003eAccess Reject\u003c/code\u003e. There is no support for RADIUS accounting.\u003c/p\u003e\n\u003cp\u003eMultiple RADIUS servers can be specified, in which case they will be tried sequentially. If a negative response is received from a server, the authentication will fail. If no response is received, the next server in the list will be tried. To specify multiple servers, separate the server names with commas and surround the list with double quotes. If multiple servers are specified, the other RADIUS options can also be given as comma-separated lists, to provide individual values for each server. They can also be specified as a single value, in which case that value will apply to all servers.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for RADIUS:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eradiusservers\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe DNS names or IP addresses of the RADIUS servers to connect to. This parameter is required.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eradiussecrets\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe shared secrets used when talking securely to the RADIUS servers. This must have exactly the same value on the PostgreSQL and RADIUS servers. It is recommended that this be a string of at least 16 characters. This parameter is required.\u003c/p\u003e\n\u003cdiv\u003e\n\u003ch3\u003eNote\u003c/h3\u003e\n\u003cp\u003eThe encryption vector used will only be cryptographically strong if \u003cspan\u003ePostgreSQL\u003c/span\u003e is built with support for \u003cspan\u003eOpenSSL\u003c/span\u003e. In other cases, the transmission to the RADIUS server should only be considered obfuscated, not secured, and external security measures should be applied if necessary.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eradiusports\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe port numbers to connect to on the RADIUS servers. If no port is specified, the default RADIUS port (\u003ccode\u003e1812\u003c/code\u003e) will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eradiusidentifiers\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe strings to be used as \u003ccode\u003eNAS Identifier\u003c/code\u003e in the RADIUS requests. This parameter can be used, for example, to identify which database cluster the user is attempting to connect to, which can be useful for policy matching on the RADIUS server. If no identifier is specified, the default \u003ccode\u003epostgresql\u003c/code\u003e will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIf it is necessary to have a comma or whitespace in a RADIUS parameter value, that can be done by putting double quotes around the value, but it is tedious because two layers of double-quoting are now required. An example of putting whitespace into RADIUS secret strings is:\u003c/p\u003e\n\u003cpre\u003ehost ... radius radiusservers=\u0026#34;server1,server2\u0026#34; radiussecrets=\u0026#34;\u0026#34;\u0026#34;secret one\u0026#34;\u0026#34;,\u0026#34;\u0026#34;secret two\u0026#34;\u0026#34;\u0026#34;\n\u003c/pre\u003e\n\u003c/div\u003e","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","ContentHash":"ef1f688b506e7b5c1afcea42ac36bc8da01504f03195a7050d610789931b15ea","Payload":{"description":["Authenticate using a RADIUS server. See Section 20.11 for details."],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-RADIUS\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.11. RADIUS Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e except that it uses RADIUS as the password verification method. RADIUS is used only to validate the user name/password pairs. Therefore the user must already exist in the database before RADIUS can be used for authentication.\u003c/p\u003e\n\u003cp\u003eWhen using RADIUS authentication, an Access Request message will be sent to the configured RADIUS server. This request will be of type \u003ccode class=\"literal\"\u003eAuthenticate Only\u003c/code\u003e, and include parameters for \u003ccode class=\"literal\"\u003euser name\u003c/code\u003e, \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e (encrypted) and \u003ccode class=\"literal\"\u003eNAS Identifier\u003c/code\u003e. The request will be encrypted using a secret shared with the server. The RADIUS server will respond to this request with either \u003ccode class=\"literal\"\u003eAccess Accept\u003c/code\u003e or \u003ccode class=\"literal\"\u003eAccess Reject\u003c/code\u003e. There is no support for RADIUS accounting.\u003c/p\u003e\n\u003cp\u003eMultiple RADIUS servers can be specified, in which case they will be tried sequentially. If a negative response is received from a server, the authentication will fail. If no response is received, the next server in the list will be tried. To specify multiple servers, separate the server names with commas and surround the list with double quotes. If multiple servers are specified, the other RADIUS options can also be given as comma-separated lists, to provide individual values for each server. They can also be specified as a single value, in which case that value will apply to all servers.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for RADIUS:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eradiusservers\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe DNS names or IP addresses of the RADIUS servers to connect to. This parameter is required.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eradiussecrets\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe shared secrets used when talking securely to the RADIUS servers. This must have exactly the same value on the PostgreSQL and RADIUS servers. It is recommended that this be a string of at least 16 characters. This parameter is required.\u003c/p\u003e\n\u003cdiv class=\"note\"\u003e\n\u003ch3 class=\"title\"\u003eNote\u003c/h3\u003e\n\u003cp\u003eThe encryption vector used will only be cryptographically strong if \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e is built with support for \u003cspan class=\"productname\"\u003eOpenSSL\u003c/span\u003e. In other cases, the transmission to the RADIUS server should only be considered obfuscated, not secured, and external security measures should be applied if necessary.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eradiusports\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe port numbers to connect to on the RADIUS servers. If no port is specified, the default RADIUS port (\u003ccode class=\"literal\"\u003e1812\u003c/code\u003e) will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eradiusidentifiers\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe strings to be used as \u003ccode class=\"literal\"\u003eNAS Identifier\u003c/code\u003e in the RADIUS requests. This parameter can be used, for example, to identify which database cluster the user is attempting to connect to, which can be useful for policy matching on the RADIUS server. If no identifier is specified, the default \u003ccode class=\"literal\"\u003epostgresql\u003c/code\u003e will be used.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIf it is necessary to have a comma or whitespace in a RADIUS parameter value, that can be done by putting double quotes around the value, but it is tedious because two layers of double-quoting are now required. An example of putting whitespace into RADIUS secret strings is:\u003c/p\u003e\n\u003cpre class=\"programlisting\"\u003ehost ... radius radiusservers=\"server1,server2\" radiussecrets=\"\"\"secret one\"\",\"\"secret two\"\"\"\n\u003c/pre\u003e\n\u003c/div\u003e","related":[],"sections":[],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"The DNS names or IP addresses of the RADIUS servers to connect to. This parameter is required.","name":"radiusservers"},{"description":"The shared secrets used when talking securely to the RADIUS servers. This must have exactly the same value on the PostgreSQL and RADIUS servers. It is recommended that this be a string of at least 16 characters. This parameter is required. Note The encryption vector used will only be cryptographically strong if PostgreSQL is built with support for OpenSSL . In other cases, the transmission to the RADIUS server should only be considered obfuscated, not secured, and external security measures should be applied if necessary.","name":"radiussecrets"},{"description":"The port numbers to connect to on the RADIUS servers. If no port is specified, the default RADIUS port ( 1812 ) will be used.","name":"radiusports"},{"description":"The strings to be used as NAS Identifier in the RADIUS requests. This parameter can be used, for example, to identify which database cluster the user is attempting to connect to, which can be useful for policy matching on the RADIUS server. If no identifier is specified, the default postgresql will be used.","name":"radiusidentifiers"}],"title":"Documented method options and alternatives"}]}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}