Skip to main content
The RADIUS attribute picker is driven by a curated dictionary that the UI fetches from the RADIUS service. It includes standard RFC attributes, common vendor-specific attributes, and Altostrat system attributes used for quota behavior. Use the picker in the UI as the source of truth. It shows the current attribute name, vendor, description, tags, input type, select options, validation type, and allowed operators.

​
Dictionary Coverage

The current dictionary exposes 51 attributes across these vendors:

​
Standard Attributes

Standard attributes include:
  • Session-Timeout
  • Idle-Timeout
  • Acct-Interim-Interval
  • Termination-Action
  • Framed-IP-Address
  • Framed-IP-Netmask
  • Framed-Route
  • Framed-Pool
  • Delegated-IPv6-Prefix
  • Framed-Protocol
  • Framed-MTU
  • Service-Type
  • NAS-Port-Type
  • Port-Limit
  • Tunnel-Private-Group-Id
  • Tunnel-Type
  • Tunnel-Medium-Type
  • Filter-Id
  • Reply-Message
  • Class
  • Login-LAT-Service
  • User-Password
  • CHAP-Password
  • Cleartext-Password
  • Code
Code is a response-control attribute used by the platform response flow. Most customer policy work uses the session, IP, service, VLAN, filtering, and vendor-specific attributes rather than editing Code directly.

​
Vendor Attributes

​
System Quota Attributes

Altostrat system attributes are used for quota-aware policy:
  • X-Octet-Quota
  • X-Quota-TTL
  • X-Quota-Reset-After
  • X-Quota-Carry-Over-Cycles
  • X-Quota-Expire-TTL
Quota attributes belong on groups, not individual users. The quota service reads group attributes, uses the lowest quota when multiple groups define one, and applies top-ups when calculating the effective allowance.

​
Operators

The UI supports these RADIUS operators where allowed by the selected attribute: The picker limits the operator list to what the selected attribute supports.

​
Input Types

Attributes render with an input type that matches their expected value:
  • Text.
  • Number.
  • Password.
  • IP address.
  • Select dropdown.
  • Duration in seconds.
  • Bandwidth in bps or kbps.
  • Storage in bytes.
  • URL.
For enumerated attributes such as Service-Type, NAS-Port-Type, Tunnel-Type, and Tunnel-Medium-Type, the UI shows friendly labels while storing the configured value.

​
Validation Limits

The picker and API enforce type checks and selected range checks. Current notable limits include:

​
Tags

Attributes are tagged for filtering and discovery. Current tags include session, accounting, ISP, IP, DHCP, routing, IPv6, network, service, authentication, NAS, access, limitation, Wi-Fi, VLAN, filtering, user experience, bandwidth, policy, firewall, hotspot, QoS, DNS, and quota.

​
Attribute Validation

The API validates attributes before saving users or groups. If an attribute is not in the supported dictionary, uses an unsupported operator, or has a value that does not match the expected type, the save request is rejected. Password-related attributes are supported for RADIUS protocol compatibility, but normal user credential changes should use the credential fields and reset flows in the UI. Do not use metadata or ad hoc attributes as a shared secret store.
When translating an existing FreeRADIUS deployment, create one group per reusable policy first. Then use the picker to recreate the check and reply attributes with the correct vendor dictionary and operator.