From afb99c5ede9bcac7a736dad1e259ccc24c1ce565 Mon Sep 17 00:00:00 2001
From: "Jens L." <jens@goauthentik.io>
Date: Wed, 14 Aug 2024 18:38:24 +0200
Subject: [PATCH] providers/radius: property mapping docs (#10908)

* migrate protocols to table

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* add radius property mapping example

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* Apply suggestions from code review

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>
Signed-off-by: Jens L. <jens@beryju.org>

* add to release notes

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Signed-off-by: Jens L. <jens@beryju.org>
Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>
---
 website/docs/outposts/index.mdx             |   2 +-
 website/docs/providers/radius/index.md      |  37 -----------
 website/docs/providers/radius/index.mdx     |  70 ++++++++++++++++++++
 website/docs/providers/radius/protocols.png | Bin 15690 -> 0 bytes
 website/docs/releases/2023/v2023.4.md       |   2 +-
 website/docs/releases/2024/v2024.8.md       |   4 ++
 6 files changed, 76 insertions(+), 39 deletions(-)
 delete mode 100644 website/docs/providers/radius/index.md
 create mode 100644 website/docs/providers/radius/index.mdx
 delete mode 100644 website/docs/providers/radius/protocols.png

diff --git a/website/docs/outposts/index.mdx b/website/docs/outposts/index.mdx
index 269a9b7b863d..2f9dec851e3c 100644
--- a/website/docs/outposts/index.mdx
+++ b/website/docs/outposts/index.mdx
@@ -8,7 +8,7 @@ An outpost is required if you use any of the following types of providers with y
 
 -   [LDAP Provider](../providers/ldap/index.md)
 -   [Proxy Provider](../providers/proxy/index.md)
--   [RADIUS Provider](../providers/radius/index.md)
+-   [RADIUS Provider](../providers/radius/index.mdx)
 -   [RAC Provider](../providers/rac/index.md)
 
 These types of providers use an outpost for increased flexibility and speed. Instead of the provider logic being implemented in authentik Core, these providers use an outpost to handle the logic, which provides improved performance.
diff --git a/website/docs/providers/radius/index.md b/website/docs/providers/radius/index.md
deleted file mode 100644
index f7966ef2f387..000000000000
--- a/website/docs/providers/radius/index.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: Radius Provider
----
-
-You can configure a Radius Provider for applications that don't support any other protocols or require Radius.
-
-:::info
-This provider requires the deployment of the [RADIUS Outpost](../../outposts/)
-:::
-
-Currently, only authentication requests are supported.
-
-### Authentication flow
-
-Authentication requests against the Radius Server use a flow in the background. This allows you to use the same policies and flows as you do for web-based logins.
-
-The following stages are supported:
-
--   [Identification](../../flow/stages/identification/index.md)
--   [Password](../../flow/stages/password/index.md)
--   [Authenticator validation](../../flow/stages/authenticator_validate/index.md)
-
-    Note: Authenticator validation currently only supports DUO, TOTP and static authenticators.
-
-    For code-based authenticators, the code must be given as part of the bind password, separated by a semicolon. For example for the password `example-password` and the code `123456`, the input must be `example-password;123456`.
-
-    SMS-based authenticators are not supported as they require a code to be sent from authentik, which is not possible during the bind.
-
--   [User Logout](../../flow/stages/user_logout.md)
--   [User Login](../../flow/stages/user_login/index.md)
--   [Deny](../../flow/stages/deny.md)
-
-### Limitations
-
-The RADIUS provider only supports the [PAP](https://en.wikipedia.org/wiki/Password_Authentication_Protocol) (Password Authentication Protocol) protocol:
-
-![](./protocols.png)
diff --git a/website/docs/providers/radius/index.mdx b/website/docs/providers/radius/index.mdx
new file mode 100644
index 000000000000..a8601371e8f9
--- /dev/null
+++ b/website/docs/providers/radius/index.mdx
@@ -0,0 +1,70 @@
+---
+title: RADIUS Provider
+---
+
+import { Check, X, AlertTriangle } from "react-feather";
+
+You can configure a Radius provider for applications that don't support any other protocols or that require Radius.
+
+:::info
+This provider requires the deployment of the [RADIUS outpost](../../outposts/)
+:::
+
+Currently, only authentication requests are supported.
+
+### Authentication flow
+
+Authentication requests against the Radius Server use a flow in the background. This allows you to use the same flows, stages, and policies as you do for web-based logins.
+
+The following stages are supported:
+
+-   [Identification](../../flow/stages/identification/index.md)
+-   [Password](../../flow/stages/password/index.md)
+-   [Authenticator validation](../../flow/stages/authenticator_validate/index.md)
+
+    Note: Authenticator validation currently only supports DUO, TOTP, and static authenticators.
+
+    For code-based authenticators, the code must be given as part of the bind password, separated by a semicolon. For example for the password `example-password` and the MFA token `123456`, the input must be `example-password;123456`.
+
+    SMS-based authenticators are not supported because they require a code to be sent from authentik, which is not possible during the bind.
+
+-   [User Logout](../../flow/stages/user_logout.md)
+-   [User Login](../../flow/stages/user_login/index.md)
+-   [Deny](../../flow/stages/deny.md)
+
+### RADIUS attributes
+
+Starting with authentik 2024.8, you can create RADIUS provider property mappings, which make it possible to add custom attributes to the RADIUS response packets.
+
+For example, to add the Cisco AV-Pair attribute, this snippet can be used:
+
+```python
+define_attribute(
+    vendor_code=9,
+    vendor_name="Cisco",
+    attribute_name="AV-Pair",
+    attribute_code=1,
+    attribute_type="string",
+)
+packet["Cisco-AV-Pair"] = "shell:priv-lvl=15"
+return packet
+```
+
+After creation, make sure to select the RADIUS property mapping in the RADIUS provider.
+
+### Limitations
+
+The RADIUS provider only supports the [PAP](https://en.wikipedia.org/wiki/Password_Authentication_Protocol) (Password Authentication Protocol) protocol:
+
+|              | Clear-text      | NT hash         | MD5 hash        | Salted MD5 hash | SHA1 hash       | Salted SHA1 hash | Unix Crypt      |
+| ------------ | --------------- | --------------- | --------------- | --------------- | --------------- | ---------------- | --------------- |
+| PAP          | <Check></Check> | <Check></Check> | <Check></Check> | <Check></Check> | <Check></Check> | <Check></Check>  | <Check></Check> |
+| CHAP         | <Check></Check> | <X></X>         | <X></X>         | <X></X>         | <X></X>         | <X></X>          | <X></X>         |
+| Digest       | <Check></Check> | <X></X>         | <X></X>         | <X></X>         | <X></X>         | <X></X>          | <X></X>         |
+| MS-CHAP      | <Check></Check> | <Check></Check> | <X></X>         | <X></X>         | <X></X>         | <X></X>          | <X></X>         |
+| PEAP         | <Check></Check> | <Check></Check> | <X></X>         | <X></X>         | <X></X>         | <X></X>          | <X></X>         |
+| EAP-MSCHAPv2 | <Check></Check> | <Check></Check> | <X></X>         | <X></X>         | <X></X>         | <X></X>          | <X></X>         |
+| Cisco LEAP   | <Check></Check> | <Check></Check> | <X></X>         | <X></X>         | <X></X>         | <X></X>          | <X></X>         |
+| EAP-GTC      | <Check></Check> | <Check></Check> | <Check></Check> | <Check></Check> | <Check></Check> | <Check></Check>  | <Check></Check> |
+| EAP-MD5      | <Check></Check> | <X></X>         | <X></X>         | <X></X>         | <X></X>         | <X></X>          | <X></X>         |
+| EAP-PWD      | <Check></Check> | <X></X>         | <X></X>         | <X></X>         | <X></X>         | <Check></Check>  | <Check></Check> |
diff --git a/website/docs/providers/radius/protocols.png b/website/docs/providers/radius/protocols.png
deleted file mode 100644
index 2a4a1b6fe2deaca24c9a2bd346604a6371230959..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 15690
zcmdUWcU)81+OAV<pdek4GKzqJz(|p%a7G0L1ZKbx#Q-*Hqyz|^Fczf4C?e7a5l~7%
zAP{O4f=EXx0qLPc2)#oBxoaor%$#%X`R;t*y?@+9<In89*4}IF^*-x)p7%}Y&&GNO
z*@W13?b>xv|KbJHUAw-+?%MSYV&5L{&HLI>eelnI*Na!(ckN>5hW>u@aR5W#wd;pn
z`WJq>?EPtGfPfT+6Y3YPM_fT1=D#IcbMx|H^~2hd1v>j`Lh=rnj5j(iid}fY-Y+wM
z`E6-f!rrb|SfTW5yN~eQyL|80f&tA#KXM~n`CM((;Ia<5q9Qw6yVbSUO08gpo}8}j
zc0ap`%C#i*C7nZD%-2=2|D)=WA;xy8seyFH6YzoK#Z^^_2*6p#AKARuW^9;{WsWgl
zvhvsgO=%T<bnt3G%DmaSG@bd;i9f&|n)Cj+J|@#YWuAxry*Bvs)}&GKIQC}!(e)9j
z_5GN8VwiJ?y5LsIesE;I)&!jP03Rk2JS_F)IEwG}=o{#JX7i)Wrp$KtQip?&qWCm9
z-f}{1dFb;zWSN`wcZZ(1`+D<gC|D(veo<4)*<SjzeY=`I7(5W(w&62FNZm^GbN9zt
zR<TvM%*T{3(GGL0VoL~Br6ZlIb~Mn1r?8?NCiMQDv43bD_p@`UZ4D=GDLGQ+#ZkB|
z{TrD5y}~b1S~*QJ*jE89?Z~DLAF}#G8AFamOxA6wA<%_5HYyN|DeC-FBZS#rf`6~!
z_AE;6s@vV;*un_<W@^*r`XbU%xq*$ya3sSg%q2&OkF@OhY}@qYc|?qLm;}S~y!BI~
z*XLbmMO#KP*zlq4W$hp^CxpvCBVzWNlO1U>f{TWY7RC4d<<nyMNI&(S={1=NW(z^i
zdKw{Yj`oS6&~(-~{7`4L--}LjdUDt)U^mQSgEfkL%pNIa?pfuSut_1UN;Q2zafnyn
z4ntoFuEVu^@@gLZVKL#c_+^3U*It*c5NlCwK|hoY;eA^u(Ks_x#9k|}cXNl}eM9sT
z!VQ#V)QkzkEF`CA!LW|Fvb;I$)0>u*hnEy99rp1Fz3=B=Y&(zka1rAtor11aG`MXQ
zv7lpcxwSDGZ^bydQ2E*^JMday;BV?(if}|*DrE|1O>eCuw23XX^evJ#TroGvRW>Q3
z78qg^m{-~AtynQsa@%SaLz)PiUe9nOC!9Hy;w4N`h2cNn<9|)#qYX4bS5hL!RSfsO
zbeK7%FDH!+r9`KUk}3kok6M;Xx{ugY2?dC(lkc#R6V^&)e9C{FX<LQ+(`2Qw?tOon
zY1-b=^nwb4H_FH)GAuyW>b49&D%OS~z{urnI~L;1IT}U{>GImEr^D`1VCX;j#9u+6
zZ|YK=%8Hd?b3wsY?{=6=phO+oxi57)>k$0)Xq-V9a(Y+wK9rHiMfM16)YQ+1;8#U3
z4NkId(%A@o5o?6IX0_5G()OHHRVIq4LiM^S?QY$dI^&W%<KmA>p7}cL=VT3k%ZlA0
z$k3(Whe{`_h_I(oLmPHys0sCx?)~J{p-E#tQ3`!Al!$wI<*5~HonE#o-u6h-4GAr%
zTeKsA+4FZwwYN;5SW*BB=(mKL;$5gn(U-T<3kLcM^Y_OS&MBf|>pYY6EE~r+i^QnE
z^Na3ooEx^4pLbhXk1MS!U3)EHmv9entL-&c_L!E@Q(X%lP~z%p+=9CG`j<O3v{f;8
zmB5}lW!bKdJx^f>2PIcZ*QuuyiRcekJ68$oTgIY<W_SFOxmXo{K{}Z%^f0R<x>C5l
zof?7&N4r#$Ej)Jj<PwnakGjjzNjbieGaJr<btZQ4bE|rYdIrLL&BYLr(M?W3?>dZ*
z-*Z$;F-Sr5c^|B`E$hU0qxo<25gBZ>wqw>Q;{hL3Hx1vck5{@WzT^F<5teg#d>xKS
zw0MD!npNO|r~1c_L}?>o^@B67!kZOd<0mYUPE!pQd#vlPzT+b$Nq3B1BAoQp8YyHy
zj*9JFXqxU{Ey?exam&!`ee|g05yiIp7`8;4tdYOnuU4Plzr9FzubO-Ic3O!nV~8G(
zvgGx1rTl~l&1u#{?A0tjpWGA5UwIU?=o{Ka7!x@Ep>=S>&P9kUl&Gum++DrZo(siC
z){s&c?zNW0YHbw${+-ubj@x&?bAN<HbBKLU)6D;ca+=SV&Xw;zeCoNZuhl?`ijli6
z<*J4&Y4}Y5=1t!~c(ZFrN-*EMa^m~Tbt<@nL;;etqVE&bP>*`McxoKJF*ho3)T=PY
z`lTpu{~jp;Qm3cN#DZE?eyEcl1P$PE-cFQRx_U%o@SuMbPn&AHLNiyJ{$^8yVX%#8
zMKG=BySb5hwb8>@C%g?2HeFuA8S)B0k`)jB^3BN-p7#k;S3G}-s^lU)&v$=W`x|aJ
zgbN;@jZX=b&o8Op-c4=eG<SK2KW+QYBeU5Z!H$+UqkJ=AWvx2qiMf^I%MtMQ3C<hd
zOTmFaGHCXGKPU<wLnlg!s-z7=8958=wmW&d5}SL=XKnQcN@Uc>DX@g_nuuPulk<%@
zJk=I^xL2f<aHjYQd?7X`c#qLJ&(zM4oI|8z<OB(qApWO^(N)D4gOxX1To@P~EbjCs
znxh(fKR5XsRIEcdb>#%L>oan#q-Zh}X=R6A_Q+j~a}eC11!25CGVjQ3-3GfSu~f~>
zDx)Mlt<B+e)Z%g`n}DUySx>@Ef+m%3$SIJxayz2UBF)T}Bf8$=N2mU~DI@h^%hv3b
z!94;7L|6#2A<E8Ng0oyl*I!alzk!$ZINyD}uaLg<)Fa78gRG$zG<P#GDFgqIUY8`v
z_da(r<bz9;QmHCgW@$t~TWdutd^8fzpU_qG14_>AjJ#sTGkl{=D014}(*8(dCSDSQ
z*|@UML2k^2|Afd8)r`__Ly6cG+Yn33iug%4lYcG7>sqm+Vg*B}Z_0k0bn>WiM@VTN
zjyv@J^O7AMlUW({%<Uq=#+H7Q^hQ(<QIyF(Vfigmlx#uwMvSqaAj^y{HfiPMUShbq
zq2xRQK0D;?=Q;M=XRGIa;9h78z0sJ%CNT4Zz_Z7iW+=IiN73@nZe<rV>m!ypp7P|$
z_*ZY~YSHR6-`DL{T-sp2bH6q}7~dGNo*ej4*ZQgLJuXtSQ*l4qI!hia5mjGCyPHGf
zf(yo3dj{qceR6m%@eK|rkcN_`U~1UtnNZTB^88mdH|x0?5%suIrT0UJlsF6EM{IoW
zrf+|9W;Ji_K{$5I!<N0OwI@p2%$MR7&#~8;tkH@_q<0L(w3$t@Cv$&$)s=UZjLS^%
zTL1MD!p4&<bhi6KX<i|~pp21qidQDtV%@vHN{;sFW7UuZRxx(l?k?ZF6hA4=sbbp3
zOOmP(+`Oe**>-LE?4`6h&;!m>xOQ*j`oqhMZffd7T5F<yc8%iL`yxa4;%fCPTWjKK
z8+=W|D}{|0ahEJ##4&`b!~F>9ZBofNJin!c8nV%Pa&l?+_ipxq+-12Y6Y8Ei)jwFU
zp^~jA{j2zAqt+941)Ys=AEicanx44z>BdBH|F^k@`){X>qPj0r7Hsa}pN^Mqwq1K*
zz3eWw(SPYUHpYs>&SGmk7jtcvCNlTYO+HvWmLGog1|~zd)#FJP1G6;eLd%%~&?>^X
zy+9A!x4KRm5#bMUlWjLXebb5)m4^&#t9&+RcMl)-U1{?Z>on>F|HV~x?yl(*CM#Rj
z4OZqupmAu<XzHa@YukE4sdki{7R&+>tXHU;dSojM|7lzIMYDh;bMuy=vstyL;9EDh
zBstE#8hX9O1t(9fOPNimy2X-~W^My8)U2~7u4+}eKM6(Jm|fQi1nY{fWfD6YN4RB(
z&NbURyj~;z+9mv!$arOal;ydbkBwJfl2o66r+9o#V#sC6zu*JON_d*yv+Z~c8{Y?y
zZ*y%8xJ40ty6#W5qvgcm`C~htvpa|c-@kY4R2e>V^_$%azwq+?9<g$Wob!gFoj=od
z`XZw4?lnnr9N~N4cR!sNr6;<H|F%#sdggbI{N^*0FI}gv3s=23kHtUrCWz<55BnM2
z*Dl@a`Uisjj&+b$?bSYmwbfi5_b`msLeUn?hvxUo@|7#P2($X?d-a74MBE#6ZigT`
z!muiTcBYoB@eWYc5Lp!8US~n-8<Dg4+m~#TE{qlGBHV-A_|1;!H7q|N;+hRg1WBv7
zt*+}d*@6JR%>x3D2kY{Sr`M$n-zqE_eB%?YG!8RB1ed(J8D|ndIUeymbRfTH&VtV(
zBuCAa9hH0+Z)+uU^D0qg!H*b=e@8@*+2P-3)P>}XiebtM)hY)fRLMd|UY|Ucv2=*k
zY?#4|ul)F#8psVliY331BcjisBCTfYLvnI|!}D(+pfpfJ9Q=u03!H>b)DI<t=YB!8
zlsC72Mjx@2#fFk#*FDgkaW(+(z{Q*T*ZH*S(Lr@8nCp?+w#!K=W#KvQh*0V<C9m1e
z+e7LZUSoTNv{e~heX`|yacq1}_0x)3YG)m~bCaX&xjMvkcKV66fO$W7Z=>CPPY<DY
z@@9;G^Jl+jjWiLtJ?4Cp*!a}ad#NMgZ9h965uAO%1FzSnE9NJQ@U^nS`Iq{8f+5Id
zZ~h}eGlNez`*^oaBk^p|yvOe*^aovUOu4UG`K!)I(@3)^;{2F@N>%zxJcsA9o~8Wn
z%`_2-J=jqLL^$S`$6JD}XIz|ym2^PJ%r^~K8RQ8IZ(MyRkp6nq`H{OpxG>FN|5&?(
zbL*Ofk6D<KK;AJdPzHCeO*AVY8~oyL6;^MRZuJJTK{9Ba3(lp<L9hAj5*#O27Wd-`
zH=}AB!|jm5nYL{+NZr&%<HLGT!z3fOsdkz7NSnt=QG8+xCI8eOQdmqK1)(q`kwDLo
zTtZ3wMRXNrlgq2B0#J#jF;CifFl^dEVwi1FpxipuAkh}We7%2u4xw`adI3$w`s&b*
z0(_N^_ndptdA#fF(Ltcyf>LWZp%0VDruK2y+Y^FTT$iq8JQTwSf%p1IaB7M7L+IJr
z)<>s4gx=r?pg4~8H|q08vcPfZOI<_|-qDi|8aOcDU_!`_S!v)n>x{3*ch0zRk=0=5
z^pPws_#@wNs+}f=K7Z{5p$%LY41OfoTCQ&8HUsv#^8L%LwRp1Px?las?XiF`?UF+z
zn>&$lGX*Q>WtBrXG3zaa0Q;a-!lyJexItF)E(9XF=523RBv69JCO@tXKI}N^<Rj*3
zcC4HxX@Y1v19j5x(9b@T1sil24jxhr?C9UORz1Wv!*F8GK6DpEm7{U5K72eX9pH|z
z{~n!N&rdG*zlBaiS9f^Ree-HG4}x1>{IJN_)Vos4sSO@B_y|E-$eVCRD~>O2daVvV
zyuUR)Su@JK9uk=^2Dc4!5b>g~=XulCqv!GG%w8}X&DZ8*=@UPaHN5@YvgcYy>hFFa
zU3x3G*>esN=N$HK#+A{ldSk0Cdro=2)<wN<hH+;95Z#x3=aTc{Sn<~LMn>PvMn7Gh
zO;sCGLAN^gLU-$tjwS?%lwhilIA6wO-4(+$tvfBnjZm{VYX?le%(NJ)<?4o)x6oX@
zYk}&?S30dWGrU)t^+TxVBq-iziw6gUh4L!a;3A$v>m#MZtASoMn@xQqwwrwuj54qQ
zS>14v9(Q=gq-O}CPX+WmxlS&>H!~r2<VI1&;&gBmV`zQrhJ+q9yL`0XrLJ$NrC`Bd
zw%FP#Ig&o<?7f~}?%x-&(@_^i6^?4Lx-6|_`3%oZf*}QRO3x1MYcWBNG>N4?pv_Gc
zcD&&vNZ1b`yUq?AI3lGgpXsB$(dNXOeJI|Z#x_m6Uo8?12JQKTOW9kjPuEVEM4zKo
zthnZ!W<Ip%kCrIWHR*GNy#D7FJM#dy!z}TTh*NJHCf~eHUE{Yrh9#m^vhMWnw?0dK
z;1XB`OHbZ|S(j^z<Mi65>3?1)fAjT`n<8{VkXt(|99lY1oMiVdAi*kUMgmynN3jVa
z+F-U=fuRdp<cJWygw-DnSf`IbTk;`zOO%-QLGT8HGr1;#8W<d`#v8rTZ~PLxft+++
zjHB?wAR>$z@fU9Yaumz5cM3PjpQ>U^V=jC7KKz0e05DR8;?nBkZ%?4y{Bgz+oYwwn
z<}X3#BUxY_5@dcn4xmnjJoP4T#}ESHFAG4Z@$NMc?u7jSa&(~ZCBoEQN3)pcgyif4
zCwRW#=x4&wpH7fv8A|`A&lj`g&3L@bUT5a=0sVyYkW}l_mdIT{&j@2GtD71ybF1mD
zuBX?jKH3%Ud;1Dv7VuZs1al+mfx^n__U`4lrd@pQ{-3*8;wMFqTvw0`uIi(e8Xd!C
z1?$~ER=##RX(E)mO?!Wf0Gy+X;wa01&|DRYQ%lZMn?rKkhRvA|pG{lE3uVM+bBWDl
zHR~u=U%j==`XQd9UzEq{D7Huhc`$FTv}TlqY(>GKVM0%1Bx^zeJ6Ai4yC@nQ!&RtQ
zf|n$^uN5%n(k5%Jk`w%s!7klemRE&A#7oz}1V|m`njRX-1s#qD`Z0^YyJP$`g_VWz
z3$-q`UH$lBl23bt+kg|934LH8#)Kj>PZ+}yG;L}l>gKYFT$+w9g1yrCD7NET#H1&l
zF`ZbjodpYm8)7yeyKgWeUCBr6=<|u!DAe*8^a5kbfAUvmKn*nlHIz}Oa>~MYML51A
zMlWU5@vbCUgYuz!s2WV-&_PuMhh4^$+k;tzr(<D9JtrZ9zL?g_rpb3i`VAA)@&N%3
z?F!46z`cL(Sbm915?l1Nb9ANM*UR0$cxBKUJ6i7Bb)aHET2-ZYax{3z4JIyJtogxV
zh!s~|aYG+dM>Tw(oL;ER{GNxjyCgC2&V!cO#<ybfjKI;g;8<a&yhOZ)D`-mAu$o-L
zu@EswfgoWGQ}g>J<MR?XoLqi@<QP!Rm5|z96Q`}Ue{Bfn&gLPPnNV_VL^+^3<U3Wc
z4>)A^>8d#(jL|ut;y77Xm%E54${+m{^I@S*1s-<mu>s&M<a*2VOK~j)8y)HG+s<eE
z*@$Qxug%FN2@&Xd7>9?y5Fiz*9bf^Q85e29{g;?n-c~nq0x!8oc`W2d9_V&v<}^og
z?2_ka@?l-wQ`W{dt`D%PGw;SP1B4cpz4=bTZp=-Xc@t=g>RA-uQ7q0uet3o%Sr9^m
z0q)YZvjmxuM3y1K#Ic^603kqNjbyO`3yM4tn_#^GDGZN<Ry+uKDAYjI{Sm8BkB+fK
zw4Wc1d^$r?I#r5!7M*?;^z{mLn4kNL39JKLNfu9-3P-LP8yJ}mObTk5020BAVSYFw
z9`f5gj;|+Q;<q#9&-!^MLTq3+j$(zN0AQZQrcIVP2QW&6@Lg$*2>^#06A0p%Cx8fn
zZt(zwV3FX-%Chc-7n%eJIRG$#oiZpD;#Df-Y!C*J`^<|WqD@f&?!v$Xw(M*j(c7bk
zph{p<L;o74XL|$Da?dBj!lY5L31P@l8_hdg?Q933Zup=_25v;o0NVYp&UHh8;7KbS
z59pEjKtzkq)K;})K5^tJiL(F=L<pcxk3*0KR)8Uxk!5gvBwhOe0-q?s%022&m&GB-
zLN${kA6ANo2UKg#g7RIOo_SUlc|F<ac`e;IS<ep9jBehEh*Y$da4?URJ|e59+e#bT
z%sY}DPIbr;(MUG#aZuUgtnJgTPN)*$5CXF}qFUtWjF_jMvDYn|J-xsr5IIVO_%NiY
zsU~gCov5OY!z)BB)Xzpgwqjt;o%0jV3UCnhw;brBrRV5^g`6vJt6XGOn<kmdaDa_;
zJx;A2Lu?0%C#}B|)TU2#Z<Np8wxkm@tTkASrgVy&@cO#hC9V8am+PAg^TlJ^)W#z}
zNq}wcU3%UZo`4r_HRu}OH&8a+c{?jw3}d)4e!hs$Q|7ek4x)sGBL_c!9-e7<)EiOG
zO&U`kzdKdMK{h~S$-Szlrmf6QwA)jw2#9+0O17Y9g_$!8R>re+)$F~VcU13;RDqD8
zR*yc3k}DWC%dE6w$b<FVfmCJm>`NSoy|0bfX1tr@lvV#^p^8EezvCp-p({U9kkC3`
zAAwtAmaJjk#LFXN-x`*g1sPh~N_mRPfgY6b=G3Lgc6u>?HGM%J&%h>_{f<1<RXo6!
zHMyk21YBdYfzvhmqi)&Px~lzI5a;rWs8ZcyTJmCbx1w}eI=`Jkbh%YOgIv-?5kuIh
zE%=c-g5V>M&l1sf@BR*U@R1^#S|3a=St-@IH8+hcrz+79Js;wlQR>2EjT<zY@%q$N
zDSsLghQn>fnF$J~QH?54>U;pm>%*QcGzpdo?}e7M^}vSFNo>)j!0aF6kN-8q;*1f=
zfd;H70?QwYBF9jo3UX?$y%X$RtaxPx1z;3$HrWL`7y>q4hzzhI@Xy=*13Wi;oCQ(<
zhTQo`Gcz;ceNPfzfMgIeN3^u|27uAK8&@vwsEiBzd|y&ZISM-|r7XMkGdnQG#2-P6
zBz;@aa3vTLB^k&Sj+71$Kfz=NIc)3@3hE+aqXd|!#uOZ2ap!zoFa^VzHzUHJTLQo*
zqQKgBSvUwNNWCHR62O9xA;zu`>w!Mvn1W^pSGeFAqma5`LMLgXq>ad@P0seHWPwjY
z1wLh(z?Lik#{rU%iSg=e1GIfp+oXG&_E={5l<>5UD5VaiHaRdp?bOrYORr3=8#G)*
zDa|QO`W?f<9KT8sSqu?2=?$$+Hf`KLP-pW8R2%%NIV%(jfm$!R+eiCWWBrP{kGpVO
z?chvRpCmV_)33ohV2e->GF{<kJTDA}A`cQNe}EGZmEg`<=u}guA{}r({ndU4!)>ce
zyDA9RE+LA(S34TnaftLnn9{ExgWWx-fXZ9GV)+%h{&GWCP-i(RX!<uQgwzK#!=g?b
z8;(78t8`yK#c1UTp{`KR26FDD^>zdm5mh!cLXlNO^vud=<E2x1>G<xu)-Vp+tUS-p
z9vU~Yx(?&F#(tvES3TA2KYPoeRaE8I(W1)f2(Luu7O~zHKXkcnWz1k({`<wLp$Zp8
z-3zzGpWV7>`SgS_48fya;q4MiO2Jg6>p@h8Y>`&y?;K2PtKLryw16E3KD@TijN#Nc
zL$xN9>wfH%zol29{I+$nf(VNcT;oSoX=&qBH$PR$`N_Dv4vJ9Zw=Cb>=pk=DUq5EB
z_2J{7JFkz4AO&yn`zv#D`D!2O29;7V@~~+HtPP5JoOmv!&?4r(XV<!A;70qMpyaSf
z-W_CACMRg*ublg+n{+?n_53esuL$mfD5DT}k8JnVvfP*`NgfhkOwt$9GYgTPFp$-9
zQK@zIYP@X3@u_Q+v~TZ>vBxLCL!gzgGOmh7&9D!D{?K45`@O=HFzMU$;s%O}1iqT=
zyA&N+&}-?lT072gp>G#FPDjJ|NE%Byh4?A&JkNUBfNK7)y#%1-il<z>c$G%CCztdE
zDzjZzpBpStB(N(fGXAK%Hp-E-4F@^@jnNoahNVhYI~jyICfl`w&$xp^`|O?9ez`Q#
z^&>uM${eR4wlk6HD3Mcgs!Iz75g%7?d)z^_#F3x9;3k!)j`}Jo2lgIF)IQ5LGuK_4
z_YcH^IF?=AKC8{EYXLkjosZ$jtHOJjvWE~9id^-{tJAaSXt+X@-bk{kQ#nffK;q@H
zB|D-r6}GE+s(rin4{ck(W;VXnCYN`{)d~vVm@!IpQ%{0j<x;|^i^q*J@i#}45LySq
zygMI&6f20Cfe+yV;0GXLnfw5fR9tYnFdkhA(F^(xpAg3y03`T>fB-lFH~^v^$YRL7
z_yQ*XFDQ~0zum`^tuIc>LspP9{Ru3HDUQUk8dmn7O1|B-OL!it1%RNo1{gty;N<&a
zD42#7lOgRe!2dD!q3Nsfc<|gI2xXE-cL7q&7Cdd~So-P^r&fF7=rrx!Y+y=9Z8|X^
z3J@dWJvXs6wWRqA<nr(H77BqsU>~#xRTupS#_~&G_rE&hcf`||j0fnb`@K75{?<2D
z8zAexM@M<n??b)Ow)4YzU~I$xkW+tw9bs~UQ0PE_5=d(7R+Fqrf1sw$eMGPYl5ele
z+cz<?XE0S0!f<*B0D1u0(7qK97*CxS0yU%k4yA_Q_PV{SOhv_z4FS`+_vsV0J~sZQ
zg&r#JJ3_W_v+=c=_DPQ#<D65jw1)ew8#6Pm?d=N|Q~!=psYl=?ofRa2T5~ql;NjL-
zuGp=M2sbj~Cu_|7O$eHBN5qIHi}Tx+i^dxbtSzpNspq`f9jD7uRpq~bDE~uM?FEQd
zS}uI!Y+P4@aB<GNxy`0vTiNN$cV6sb1(1X#%=;e~45NNs6)ROp{xDge{-B5V23bR)
zLEVZo&r3B}mpZ#Ou7O?WB5jx}O?zft>Kgmq@+>COwSD$NR>0^NDx{PsBW!d7Wps&0
z{@4phVoBKV&?vjFG|B=FL**$EWWsZzNRD2AVNy-f*!Z=kXWP&`D_T;QHgxSV7VOsB
z>&N>8;Vsg|;PM%%GX2g$9m^Y98dkE(T~6Xj%JNy|u$iX4OeRm45yx&&GL3KHZXU%d
z{gdM&dk8#a>N$>2lS`K9N^^VEqh+!Me=sQj0Bv3Fk`vUoygDWBJl3AG?1%-9jg4dA
z(2nDhm%ZwLR}5u2)iiP-s$ezKs7$yuJ2ym-ko2et#YFC|<RK!YL#QMW>`WMd;*h1J
z0Qb?bVlpCDpvhu5`k}}J8*3Od6akoIjAr~vTm2KK0BQ`{*Z~Ov+#F}{x2)IOD|I+O
zsSL?iv&#p*XfX)1ROHWxD>XFVLWzYdIY9bK0GbG1Ok;KpQwwpyMHHBvMGyExvI}pS
zG07xrJH87vOm+xPIM1_&$+|^IyRifr3r?6gz(PNOpkR~`f<jpevId5B34(Q~8;F9v
zDhsDJZ0EH5JhH5Cd6+T2Jbwa}3cMHoQ;Dke>d}6}#$iGqAqQs7S9j}7C1=G4(xJeC
z`*U)uc(K~IR^7DswBB#GJ%a}OyrbcI3l5ccg7d^I(ti5OHFQFe4=)^)khY7%0p<a(
z1~hBi`7OmT)WL4fNv-A4>lb**z|%hzSCLN7U(tVS)QFf{9dwEbp(ZgrPu(2~)c%Gh
z6iyBHOWP_Iv9QzqOW)%Hq~eRZw-v8do2G~E50%;WZy>3kN${0>*)SAdRXsZ=>D<Q9
z^vFQ5ku~NBmYZ9dfl>>;&%ZT7_yI3>Wy>6Rxh?7-%Kji-G9k!7-X%3*1VeMN;_71T
zlhViJ@}fZhjk&=&%d_>ZgC7o)6OKMfpVhpJH{NoI+bF$M8CAJv_Eg8H?tem`l7LZD
z6VIKM##Qlc`okdI4bwK%hOa`#Jb8$6(~~=y`^*`+(&c@W%XR3}ffZT=;u4>*zQ{9M
zBZLzFQrTB2cmo6+eGI4YDvmL<PfGWIdG-=|prL#{5MAxDBX}GH><k*<=aS@ipVI5p
zP012W^rbmodGV2(RcZqgEI#tcJC4qG8W(!V<(~<b)2Nuzak)xmwHA$%eFCVhW4T+a
z=$_3DXZ(np8i0s0pc$!Ux!nMvR4^oKE#+%BvTlm+W--IO_aVqT9xh|wUQ}><Q9PDi
z6UQCLi)|t$Z3u;7Uup((k$SggHrv#d*%Ft$MAvI>jxB%o4WWKo@U^e1P*=9_no}S_
z`%`Oa!i`c*n{3IwGgAx52lqXtG-i&lz;tslF&%GfX)bv_yU}>R{7G!>P4f$gQ8%BJ
z6gx~5^$x?6G{+$0)>3nx5i5j^^9Sg+#P4{*Q?^_;7)J=&xnuU0usU2TJ^LisyK@E>
z3{vwU1`fnmz($J+LdnK)nYY^^9GMa#k=0~7pnZB%y#p3xw_QqYnA$*UpK0Zrcesd*
z&0@1g{I?+VsRbe&`}Bxrn;VKO6kr{nFH6<HR;_7a@vRh>I4!vPs$a+BZpXhz(c%?a
zJtWN1<rBFR9V_fnEobsotUr+nF;9jbgQ^$8z#E^}8*x2?WmjMW0(P5!lA{!Mu!Kyl
zIqX~?;8dL&$6d{Bbeh-4BM?#FLDQW-OPAz_bBSYDkj$_FAPS)vi=eTj8U%JM$l}x9
z>&yf-PVfZ)HAwG4;tmpT{}!PDE<>abKpJ3m7XMdW@7MU~x_ISqC7?f{{ew+=$JP2X
zXFT?w#Uxa{2=P$XE&i2;vJmy_{?o;ju#m5H2ek#LlT}b_xU)zw&#W$jdO|BT^e==-
z4On0P5*haaK%#aNal=SWK);U7EtG>KQU@2IgW-4kY~bL~Z+NU5^50^tPdL)F9HMud
zt7A@038#o?MnIaL*4Z;ca-~<>Qt67n4=-_%B%H)%gH}5{?UM!n!uTfSvHGX_0+ddk
zkfNdaNj(=Gr{^B6(63sv9U}1^$zlKMfd82$vMliM=N*AO+)qW(&ChJloTw4(aM=63
z;)ZYICBu|Qc*$9UUk_t#zH?}rqTMTn%^74FV;ve{NRf5e_;t@uj={!RJf0Sjcl%64
zJz8B{g6}_!BALS7NAFoveo|^gmxi(eF?qvC5}R>BULG58>Ii=c5_Puew`%PCYKrPn
z0*T-i(05`oF%r*FT`G)HP$paC?ap%)*GhHyI}-CMswJjOaq;PjnvQ6oZ@ALIs27sD
zf%)5~dpolAQb#RtyA!64X(9jc$~eHobw;b#_{!&~sN2IMhgRY^Tg-c2^<4Z0TE1eK
z*u$un$8T<YBW%1HP^jx+rv<X~-?Y-VDq%r6DmwT^a=B-vsKuN!M`ZT^tqBe7Y)g5z
zJu}Af*$qEc_|k<&ejf-mroCg*rTl98Q?fAWq)*k8iY{JK^V;%rE3<pl<JiB$_uLVn
z@UnQ|!2_%Q{4o!*j}c!hC}s8AC%$b(#F>&d{r|~jmjgqb%wj8L8tu_hBsL>--#)3x
zrdQ4|+9E3jM%W#S9F({wuP3rZ#L0TUdR6c`=$ZK)R3;)mT5As~FN(YWz@M{l|CtlY
zkS&%UpS}t{D_eamIix5n5m%BN>>sFY_MiG7g^m4qk1+QjKLuS=N-&4{RlkYG%dd>P
z?$NvA*O3X588CBVgmvrtaWy6=O|`oCLc|E!@&6-3gwls#5eZ>F-DbM!U-E$<Bd84M
zUsqIZly$8M0ADCc2vtLLO|Pra=R25haqKZ-m+^UUoOQ<6<I1cvYJX!jSYVxAYXTaq
z@RQm+=^)ShGbWW~)Pl62Mc9AA5a0cl@s?uLxlOB?liH>Ooi&Z|bE%cqlfc5i>dS?<
zoP>>1&b;<*xMp!H%ZUJeCxjy({>m|aOReV!Z)I|AbQ$>*!)MVeTx-aub?{;Gf%xf$
zI}4=W<Z2seV_Miwm->YfD|_v{MPslLJ>5v0(8aH9ncFj5nEMhGB;wfJI*QVde8gj}
zetaezY83IrR_c^cg37nP+s|%=A{VQOR)*c91}&b#k?k5o4nT&Qk1+GP8}=K4TjIIU
zd^0B<6yoAn^-e_BzFi@R6A~pN({H~X4zW**I7AvNCigtCKZ+eFS=~h0WIpRg)khD7
zl}0o6MawGdfIWe=^cr1S$q9$IrVZ@QoeL%wya_>aami`Nmc7JFX30f+waTIL-bRfs
z{ny!j3I0<CA;aVQY@+CqXX<fYj1hO+nDp1DP?2&UFJrQQ1jhGnT`GpAac9e4wf`lZ
zIXMe`6AHB?6S0RCsb6MWn{09OLQ&vQ^=AnQx9jCjgV{Aftxj@3CVO>$hTL<T<9{dN
zuSiZnH9R|cR8C#OI~Nopa>FS=zrFSRH}=-R!e}XZX3n<9yPEHlLVm06wukB&I^43_
zi3Mz&gsG*(RJ^Uh^>^>bpAgYMKMTL4R{{nmLa@voT=f@M*3Ju32=wQkCFC?QNB28A
zAGYS9bSJ4F|7>DwOuO{UY6WA|MJ#1?>1MH;7$G|1hNX|z^MDG&wF)B6nSvku3lRP1
zasV@4lDB2Z=a-Kf#@hTy7Rj0TDDS-ZXzO*A+n4UkqvYjLc|U(O@u_)2Gf;JgPqjaO
zX~^VUy}(Wi5_noMI~sK-6hZhwCU(oe#x67nX1*Up_c_E2h-GE)hNAgP1J?0_+92P;
zth-^B(LihVlT0Xeb#=AQ31sxXr1LiXh5^YM{qf}SouYta;h<oO`D>6zT>_-pWZ>(U
zcPM?a_92Z3e*PiXdR!?wW;6$V(|?`JjyuPcpAZ>_-QD3nAaM`*>cPzXL8$CbR-A4G
zsZ5qCZM=H~5~(I&@DSz0iK9WPo%IWoFDF111yCpd+UGH}0IBWIiNdd5eJ_q?d&R<-
zGn#u%oo%ljSCNl<(h|OY<i*RQ$yEn6ee$I!6rVXKU{)<p?ispPt~e-*$_pw!ZB<g+
z4WQ?TKj;0Pg8+XLaA2?B?&Cim#cria1(pskWe|&tpqhaYTLdDeEtVm)8Lej;ihLe`
z7x-k-mxi|e^KDsRP)6amFGv>Esi<&QFfb7m!|K+x8>)5>)M!-_V=873z}!@c{`>L)
z^Pdp3n_j{ki^mlV5i!RsOc7qI(F%+KT2&6Er&m)(8hc+H*DwS!rYZyf-CUx2IP&I$
zBH3vDSC>o#<bMPu_bCpU_>>{W;)+#@xZlDY`2EaSK_%Wcl5U$aDs%)Ui3Q7|t+aN_
zZs@^^cAiY7#bQTXQWL}F0nd;cNYM9dSd)@-!x?aj;g0q5)DxB2dCXvcZv`)LY~y+F
zT4d_zrwYcrdeL`^@lQtwcdD{Gq{EQgm&duo4Y){-5hdGyXh&ICoVW+2&@3id3l!Ik
z{}X+ZRV05RxL6MtzBuIt8#!k7KuH&|w+&h4-vWMr)9H6o+29faZe|)yI!_&FN&C?4
z7g!cWoq|DbSwAa(*#!G%zs#MNG!pciTTt=zli?b2f_DqNO*IN{%jUIjH~gX`7RE#R
zKdw;N0CgIbHkSla((n_JA;u-y^JPhTy4HsJ@+iwKBu?wkg-hA$yUY2_jQa9i6SS;}
zAU^05|HeuKI?%n<riHsAgO60X=BARJ^rW{i=La4VOw8-xUpW*hc3?8AEzSeVj;hPa
zKej?Nk$+@vUF$9Ws7zTdVF{Op)U_8NyNSjZipo;GB8t21QJH^YPuFq+)nngsl@Asl
zi8BKmw9o&>T|>O-W7Q%2A@iUlA+v61N5su6FEIaG3+e#406N9~Yh3^U07w?Hpo`e`
zwa3o?yU<k^4_WfYX<*kQbXgzPy*9obPPoW-7^;O8LUo}aAmRnP9jlh{C*YeG0S8(K
zN;T}1Fle+gPw4_=0;oa!RP$#wsD=Tm&tMjIK~_;N7(ExrOWtJGGlFd7Ri>bgg^HtI
z3^MDRMC>5c<RbA+6Z|Ey>v{N{jN^ZSV)4;R>-`NRmHG0R=+^*@Br%<VjIH`cTH>@Y
z=60S6AL(6_XU}FDpAhi=z>PsQZ&(9bJKIbk?mRUDPlgMkS`M|R`9s)tTmCDyNo2S)
z0xsk8B~&((972r^+{r7)ADrG+6&%I!kl1FFAze5%tL$Oxk;Df*CX2d9<zMJk`ty$<
zb0MesZGuqU$&-)vbIHkK7k=qnyRoK|5|Vkr>jiHXLlX5t0t*{LDW9YIXDzI+B)IQP
zE$|W?Tli`Dfe&zv2ArU*Qfg}wfcEg_(4(OiZqiApGjR!=YT>7t7Vz_}K;?B`?)+2g
zIJG&K$Lb>Sc=M9~Tu0@R^sjYPsAS|$h2<rr6qavH)edF!{wDkwkEyz{B_2?*v?ZNz
zC^4XI)Z{UTu`HW8yVkW8!;Rq%3q?+H-6EHh&6NL0PkQ6VvJ})=ewshn<((JZ<<tcj
z`K@sr-~q!NOBqYY{g<e6Ic%fwxVm`L@Dm3kf0k^cHCMaPg-OdH_SwFsS3EUb$lC(>
zr=)X8+7<q@)cO+z*LhHRS$OOhFO4gND#I$ixLnWy3w{;04jW@-4eVcVfE=1dI@<bS
zeyY|1FYN%}u;x%gsPoGGNw120a@gXys)49Xr^K)71y$7a`vt@;_NSiqckLFKSbh&O
z#NaX_`N7>4iRaVv*0!^^jnjQ8r<e)MYr8cqSJdh`2wm8(H5$Nd`+aLDxnO(I6CW>{
zM@!X+=mwj)o)MH}u*v#9POBdG>-9N;QOMMAo9AluUOij(Fi;krBl|^+{<Vgq3kB71
zgqm#n>q8t}$v#lE_T5rmJH`hmRG(EbGD4VAv<MbM9ZVY@cXG>QSNIwH0>N(-*kB2T
z=6u+>%Ol}keJL&vCbDqz<IyHHTV5+Y4wv1s9hjL;<Rr8^C1oZ!KZpS(SRL5`8^40Y
zL1TASH>IPc0OdAHR?d=Qlv(mj0!w|ussepw`FZ+p;k=~fWpb`gvZAQ_G8z%g*h9q0
z%-Gs*7Yd#Z^yU3Dlox#ME*^U)3#4RUL@7ZfW~fvsePIW(d96+pJxh8cAJ&G<oquW2
zNE)@+i&3&lnl!ke*Klh(AsckwdC#O*oVY-Gx~3Zcxe6F5@r5WU|CL;x>a7)XCr=?*
zMN;GNK1-KRiA}FS5%L-H7m<*1bp;c&w7$628mPTLStwv3%DM%rg6PhNF@*CRL6Q%`
zudYBa5-6jXy%VkgyqF3PxNBgpAv>;%S-Z*1D*(8HxEWL_0?9^DImra4FbJ*0S!Gxt
vil9@n8TYIQ{#GH`z8y-*6@LN25R2PoqmQ{FGY@_oy-Q!m_yYFa^?Uyd%We69

diff --git a/website/docs/releases/2023/v2023.4.md b/website/docs/releases/2023/v2023.4.md
index b0baaf95979a..5b80dd5829d1 100644
--- a/website/docs/releases/2023/v2023.4.md
+++ b/website/docs/releases/2023/v2023.4.md
@@ -23,7 +23,7 @@ slug: "/releases/2023.4"
 
     The RADIUS provider also uses a flow to authenticate users, and supports the same stages as the [LDAP Provider](../../../docs/providers/ldap/index.md).
 
-    Documentation: [RADIUS Provider](../../../docs/providers/radius/index.md)
+    Documentation: [RADIUS Provider](../../../docs/providers/radius/index.mdx)
 
 -   Decreased CPU usage for workers
 
diff --git a/website/docs/releases/2024/v2024.8.md b/website/docs/releases/2024/v2024.8.md
index 4346bd056255..ffc410636568 100644
--- a/website/docs/releases/2024/v2024.8.md
+++ b/website/docs/releases/2024/v2024.8.md
@@ -66,6 +66,10 @@ To try out the release candidate, replace your Docker image tag with the latest
 
 -   **Source property mappings for SCIM, OAuth, SAML and Plex sources**
 
+-   **RADIUS provider custom attribute support**
+
+    With 2024.8 it is possible to define custom attributes for the RADIUS provider, for example vendor specific attributes like Cisco's `AV-Pair` attribute. These attributes are defined in property mappings which means they can be dynamically defined based on the user authenticating. See [RADIUS Provider](../../providers/radius/index.mdx#radius-attributes)
+
 -   **SAML Source encryption support**
 
     It is now possible to configure a SAML Source to decrypt and validate encrypted assertions. This can be configured by certaing a [Certificate-keypair](../../core/certificates.md) and selecting it in the SAML Source.