Remote Authentication Dial-In User Service (RADIUS) Attributes Suboption for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Information Option
updated by
- rfc-9445 — RADIUS Extensions for DHCP-Configured Services
Extracted elements (13)
The set of allowed RADIUS attributes is intentionally restricted to avoid creating dependencies between address allocation state on the DHCP server and session/authentication state on the RADIUS server, keeping the two services loosely coupled.
The specification's scope is intentionally limited to localized, single administrative domains; global interoperability across administrative domains is explicitly not required, acknowledging that RADIUS semantics are not designed for cross-domain use.
Robust interoperability is only guaranteed for RADIUS and DHCP service implementations within the same single, localized administrative domain. Cross-domain interoperability is explicitly out of scope.
The DHCP relay agent SHOULD include only the attributes listed in Section 4 (User-Name, Service-Type, Vendor-Specific, Session-Timeout, Framed-Pool, Framed-IPv6-Pool) to avoid dependencies between address allocation and other state between the RADIUS and DHCP servers.
The RADIUS Attributes suboption MUST only contain attributes provided in the RADIUS Access-Accept message. The relay agent MUST NOT add more than one RADIUS Attributes suboption in a message.
The relay agent MUST include the User-Name and Framed-Pool attributes in the RADIUS Attributes suboption if they are available, and MAY include other attributes.
When the DHCP server receives attributes not included in the allowed table (Section 4), it SHOULD ignore them, since using unanticipated attributes might cause side effects not anticipated in existing RADIUS specifications.
The allowed RADIUS attributes to include in the suboption are: User-Name (1), Service-Type (6), Vendor-Specific (26), Session-Timeout (27), Framed-Pool (88), and Framed-IPv6-Pool (100), as derived from the RFC 3580 analysis.
The RADIUS Attributes suboption is a suboption of the DHCP Relay Agent Information option (RFC 3046). DHCP clients are never aware of relay agent options, as these are exchanged only between relay agents and the DHCP server.
IANA assigned suboption code 7 for the RADIUS Attributes suboption within the DHCP Relay Agent Information option suboption registry. No new namespaces or other IANA-maintained registries are defined by this document.
Message authentication for DHCP in intradomain use where out-of-band shared secret exchange is feasible is defined in RFC 3118. Potential exposures are discussed in RFC 2131, Section 7.
The DHCP Relay Agent option depends on a trusted relationship between the relay agent and the DHCP server. Although perimeter defenses can block fraudulent relay-agent options, a deeper defense using the authentication suboption for relay agent options or IPsec SHOULD be deployed.
The RADIUS Attributes suboption (suboption code 7) carries RFC 2865-encoded RADIUS attributes. Its format is: 1-octet SubOpt code (7), 1-octet Len (N), followed by N octets of RADIUS attributes o1...oN encoded per RFC 2865 rules.