Permissions
Permissions and RADIUSaaS REST API access tokens can be managed under https://YOURNAME.radius-as-a-service.com/settings/permissions
Overview
The Permissions menu allows you to control access to the RADIUSaaS Admin Portal and the RADIUSaaS REST API.
RADIUSaaS leverages Microsoft Entra ID (Azure AD) as identity provider for the authentication when logging on to the RADIUSaaS Admin Portal.
RADIUSaaS does not store or manage its own administrator identities. The authentication is delegated to the corresponding Microsoft Entra ID (Azure AD) tenant of the provided UPN (SSO).
Therefore, administrators enjoy the comfort of working with their own Microsoft Entra ID (Azure AD) accounts and do not have to setup additional accounts. All applicable Conditional Access (CA) policies are enforced.
Changes to the role assignments and invalidating user tokens only become effective after clicking on Save.
Roles
Administrators
Microsoft Entra ID (Azure AD) UPNs entered here can access the RADIUSaaS Admin Portal and full read and write permissions on the service. These permissions include:
View dashboards and Logs
View, add, change, delete Users
View, add, change, delete RADIUS server certificates and trusted certificates for client authentication and RadSec
View, add, delete Proxies
View and change others settings including permissions
Access to all API endpoints and CRUD operations
Viewers
Microsoft Entra ID (Azure AD) UPNs entered here can access the RADIUSaaS Admin Portal and full read permissions on the service. These permissions include:
View dashboards and Logs
View Users
View, add, change, delete RADIUS server certificates and trusted certificates for client authentication and RadSec
View Proxies
View others settings (permission cannot be viewed)
Access to all API endpoints - limited to read operations
Users
Microsoft Entra ID (Azure AD) UPNs entered here can access the RADIUSaaS Admin Portal but can only access the Users portal, where they are able to create Users for BYOD or guest access.
Invalidate user tokens
During authentication to the RADIUSaaS Admin Portal, each permitted Microsoft Entra ID (Azure AD) account obtains an access (bearer) token that is cached in the browser's cookie store. The lifetime of the token is 30 days. Furthermore, RADIUSaaS has permission to refresh these access tokens.
In a security event, RADIUSaaS Administrators can invalidate all previously issued access tokens by setting the minimum issuance date to now.
Access Tokens
Access tokens are required to authenticate calls to the RADIUSaaS REST API.
Add
Follow these steps to create a new access token:
Click on Add
Provide a meaningful Name for the access token
Set the permission level by selecting a Role
Select the lifetime of the access token
Click on Close
Delete
To delete an access token, locate it in the table and click on the bin icon:
Permissions Consent
Microsoft Entra ID (Azure AD) accounts that log on to the RADIUSaaS Admin Portal for the first time must grant RADIUSaaS a limited set of permissions in their Azure tenant.
There are two alternative ways to provide consent:
User Consent Each user accepts the consent upon first login to the portal.
Admin Consent An administrator can consent on behalf of the organization for all users.
User Consent
If no consent has been given on behalf of the organization before by an admin, a user will see a permission request dialogue:
Users can review or revoke this consent in Microsoft My Apps.
Administrators can review & revoke user consents in the Azure Portal (Microsoft Entra ID > Enterprise Applications > RADIUS as a Service):
Admin Consent
Rather than requiring consent from each user, administrators can grant consent for all users on behalf of the organization, when logging in the RADIUSaaS web portal for the first time:
Alternatively, administrators can grant the consent on behalf of the organization in the Azure portal (Microsoft Entra ID > Enterprise Applications > RADIUS as a Service). In Azure Portal, administrators can also review or revoke the consent:
Last updated
