Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation  Back up to About Overview 
  
[+] Expand All
[-] Collapse All

redirect.ini File

Account redirection lets you flag an account for special processing after a configurable number of failed login attempts within a configurable time period. The redirect.ini initialization file specifies the settings used for account redirection when users forget or mis-enter their passwords.

[Settings] Section

The [Settings] section of redirect.ini (Table 54) enables and configures account redirection settings.

Table 54: redirect.ini [Settings] Syntax

Parameter

Function

Enable

  • If set to 0, account redirection is disabled.
  • If set to 1, account redirection is enabled.

Default value is 0.

Note: Account redirection and account lockout are incompatible. Do not enable account redirection if account lockout is enabled.

Lockout

The number of seconds in the account redirection lockout period. For example, a lockout period of 86,400 seconds locks a user out for one day if account redirection processing fails to authenticate the user.

Default value is 600 seconds (10 minutes).

Profile

The name of the global profile that supplies the values and attributes used for the user after account redirection is triggered.

Default value is Redirect.

Redirect

The number of seconds during which a user is in redirect state. If the redirection period elapses without another user authentication request, the user is returned to normal state.

Default value is 120 seconds.

Rejects

The number of rejected attempts before redirection.

Default value is 3.

Within

The period in seconds during which a specified number of rejects causes account redirection.

Default value is 180 seconds (3 minutes).

For example, the following [Settings] section of redirect.ini specifies that, if a user fails authentication three times within 180 seconds, the user account is placed into redirect state. If the user does not submit another authentication request within 120 seconds of entering redirect state, the user account is restored to normal state.

[Settings]
Enable = 0
Rejects = 3
Within = 180
Redirect = 120
Profile = RedirectProfile
Lockout = 86400

If the user submits another authentication request within 120 seconds of entering redirect state, the user is accepted without authentication or authorization processing, the user’s account is placed into accept-pending state, and the RADIUS accept message for the user contains the values and attributes specified in the global RedirectProfile profile. (These values or attributes can be used by an external customer process to direct the user to a secure webpage that asks for alternative authentication information or billing information; the external process might then mail the user an access password if the user satisfies the external process requirements.)

When a user is in accept-pending state, the user’s next authentication request determines whether Steel-Belted Radius Carrier accepts or locks out the user:

  • If the next authentication is successful, the user account is returned to normal state.
  • If the next authentication fails to accept the user, the user account is locked out for 86,400 seconds (one day). During this lockout period, authentication requests for this user are rejected automatically, even if the user enters the correct password.

[ClientExclusionList] Section

The [ClientExclusionList] section of redirect.ini identifies the RADIUS clients that are excluded from account redirection processing. Each entry in the [ClientExclusionList] section of redirect.ini consists of the name of a RADIUS client device, as configured in the Steel-Belted Radius Carrier database.

Modified: 2018-01-11