Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. radius
  6. AuthBackend
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.radius.AuthBackend

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Configures an existing RADIUS auth backend mount in Vault.

    The RADIUS auth method allows users to authenticate with Vault using an existing RADIUS server that accepts the PAP authentication scheme.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const radius = new vault.AuthBackend("radius", {
    type: "radius",
    path: "radius",
});
const example = new vault.radius.AuthBackend("example", {
    mount: radius.path,
    host: "radius.example.com",
    secretWo: "supersecretpassword",
    secretWoVersion: 1,
});

    import pulumi
import pulumi_vault as vault

radius = vault.AuthBackend("radius",
    type="radius",
    path="radius")
example = vault.radius.AuthBackend("example",
    mount=radius.path,
    host="radius.example.com",
    secret_wo="supersecretpassword",
    secret_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/radius"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		radius2, err := vault.NewAuthBackend(ctx, "radius", &vault.AuthBackendArgs{
			Type: pulumi.String("radius"),
			Path: pulumi.String("radius"),
		})
		if err != nil {
			return err
		}
		_, err = radius.NewAuthBackend(ctx, "example", &radius.AuthBackendArgs{
			Mount:           radius2.Path,
			Host:            pulumi.String("radius.example.com"),
			SecretWo:        pulumi.String("supersecretpassword"),
			SecretWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var radius = new Vault.AuthBackend("radius", new()
    {
        Type = "radius",
        Path = "radius",
    });

    var example = new Vault.Radius.AuthBackend("example", new()
    {
        Mount = radius.Path,
        Host = "radius.example.com",
        SecretWo = "supersecretpassword",
        SecretWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var radius = new com.pulumi.vault.AuthBackend("radius", com.pulumi.vault.AuthBackendArgs.builder()
            .type("radius")
            .path("radius")
            .build());

        var example = new com.pulumi.vault.radius.AuthBackend("example", com.pulumi.vault.radius.AuthBackendArgs.builder()
            .mount(radius.path())
            .host("radius.example.com")
            .secretWo("supersecretpassword")
            .secretWoVersion(1)
            .build());

    }
}

    resources:
  radius:
    type: vault:AuthBackend
    properties:
      type: radius
      path: radius
  example:
    type: vault:radius:AuthBackend
    properties:
      mount: ${radius.path}
      host: radius.example.com
      secretWo: supersecretpassword
      secretWoVersion: 1

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "radius" {
  type = "radius"
  path = "radius"
}
resource "vault_radius_authbackend" "example" {
  mount             = vault_authbackend.radius.path
  host              = "radius.example.com"
  secret_wo         = "supersecretpassword"
  secret_wo_version = 1
}

    With All Options

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const radius = new vault.AuthBackend("radius", {
    type: "radius",
    path: "my-radius",
});
const example = new vault.radius.AuthBackend("example", {
    mount: radius.path,
    host: "radius.example.com",
    port: 1812,
    secretWo: "supersecretpassword",
    secretWoVersion: 1,
    unregisteredUserPolicies: [
        "default",
        "guest",
    ],
    dialTimeout: 10,
    readTimeout: 10,
    nasPort: 10,
    tokenTtl: 3600,
    tokenMaxTtl: 7200,
    tokenPolicies: [
        "default",
        "radius-users",
    ],
    aliasMetadata: {
        username: "name",
    },
});

    import pulumi
import pulumi_vault as vault

radius = vault.AuthBackend("radius",
    type="radius",
    path="my-radius")
example = vault.radius.AuthBackend("example",
    mount=radius.path,
    host="radius.example.com",
    port=1812,
    secret_wo="supersecretpassword",
    secret_wo_version=1,
    unregistered_user_policies=[
        "default",
        "guest",
    ],
    dial_timeout=10,
    read_timeout=10,
    nas_port=10,
    token_ttl=3600,
    token_max_ttl=7200,
    token_policies=[
        "default",
        "radius-users",
    ],
    alias_metadata={
        "username": "name",
    })

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/radius"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		radius2, err := vault.NewAuthBackend(ctx, "radius", &vault.AuthBackendArgs{
			Type: pulumi.String("radius"),
			Path: pulumi.String("my-radius"),
		})
		if err != nil {
			return err
		}
		_, err = radius.NewAuthBackend(ctx, "example", &radius.AuthBackendArgs{
			Mount:           radius2.Path,
			Host:            pulumi.String("radius.example.com"),
			Port:            pulumi.Int(1812),
			SecretWo:        pulumi.String("supersecretpassword"),
			SecretWoVersion: pulumi.Int(1),
			UnregisteredUserPolicies: pulumi.StringArray{
				pulumi.String("default"),
				pulumi.String("guest"),
			},
			DialTimeout: pulumi.Int(10),
			ReadTimeout: pulumi.Int(10),
			NasPort:     pulumi.Int(10),
			TokenTtl:    pulumi.Int(3600),
			TokenMaxTtl: pulumi.Int(7200),
			TokenPolicies: pulumi.StringArray{
				pulumi.String("default"),
				pulumi.String("radius-users"),
			},
			AliasMetadata: pulumi.StringMap{
				"username": pulumi.String("name"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var radius = new Vault.AuthBackend("radius", new()
    {
        Type = "radius",
        Path = "my-radius",
    });

    var example = new Vault.Radius.AuthBackend("example", new()
    {
        Mount = radius.Path,
        Host = "radius.example.com",
        Port = 1812,
        SecretWo = "supersecretpassword",
        SecretWoVersion = 1,
        UnregisteredUserPolicies = new[]
        {
            "default",
            "guest",
        },
        DialTimeout = 10,
        ReadTimeout = 10,
        NasPort = 10,
        TokenTtl = 3600,
        TokenMaxTtl = 7200,
        TokenPolicies = new[]
        {
            "default",
            "radius-users",
        },
        AliasMetadata = 
        {
            { "username", "name" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var radius = new com.pulumi.vault.AuthBackend("radius", com.pulumi.vault.AuthBackendArgs.builder()
            .type("radius")
            .path("my-radius")
            .build());

        var example = new com.pulumi.vault.radius.AuthBackend("example", com.pulumi.vault.radius.AuthBackendArgs.builder()
            .mount(radius.path())
            .host("radius.example.com")
            .port(1812)
            .secretWo("supersecretpassword")
            .secretWoVersion(1)
            .unregisteredUserPolicies(            
                "default",
                "guest")
            .dialTimeout(10)
            .readTimeout(10)
            .nasPort(10)
            .tokenTtl(3600)
            .tokenMaxTtl(7200)
            .tokenPolicies(            
                "default",
                "radius-users")
            .aliasMetadata(Map.of("username", "name"))
            .build());

    }
}

    resources:
  radius:
    type: vault:AuthBackend
    properties:
      type: radius
      path: my-radius
  example:
    type: vault:radius:AuthBackend
    properties:
      mount: ${radius.path}
      host: radius.example.com
      port: 1812
      secretWo: supersecretpassword
      secretWoVersion: 1
      unregisteredUserPolicies:
        - default
        - guest
      dialTimeout: 10
      readTimeout: 10
      nasPort: 10
      tokenTtl: 3600
      tokenMaxTtl: 7200
      tokenPolicies:
        - default
        - radius-users
      aliasMetadata:
        username: name

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "radius" {
  type = "radius"
  path = "my-radius"
}
resource "vault_radius_authbackend" "example" {
  mount                      = vault_authbackend.radius.path
  host                       = "radius.example.com"
  port                       = 1812
  secret_wo                  = "supersecretpassword"
  secret_wo_version          = 1
  unregistered_user_policies = ["default", "guest"]
  dial_timeout               = 10
  read_timeout               = 10
  nas_port                   = 10
  token_ttl                  = 3600
  token_max_ttl              = 7200
  token_policies             = ["default", "radius-users"]
  alias_metadata = {
    "username" = "name"
  }
}

    Create AuthBackend Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AuthBackend(name: string, args: AuthBackendArgs, opts?: CustomResourceOptions);
    @overload
def AuthBackend(resource_name: str,
                args: AuthBackendArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def AuthBackend(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                secret_wo: Optional[str] = None,
                secret_wo_version: Optional[int] = None,
                host: Optional[str] = None,
                mount: Optional[str] = None,
                token_bound_cidrs: Optional[Sequence[str]] = None,
                token_explicit_max_ttl: Optional[int] = None,
                port: Optional[int] = None,
                read_timeout: Optional[int] = None,
                namespace: Optional[str] = None,
                dial_timeout: Optional[int] = None,
                alias_metadata: Optional[Mapping[str, str]] = None,
                nas_port: Optional[int] = None,
                token_max_ttl: Optional[int] = None,
                token_no_default_policy: Optional[bool] = None,
                token_num_uses: Optional[int] = None,
                token_period: Optional[int] = None,
                token_policies: Optional[Sequence[str]] = None,
                token_ttl: Optional[int] = None,
                token_type: Optional[str] = None,
                unregistered_user_policies: Optional[Sequence[str]] = None)
    func NewAuthBackend(ctx *Context, name string, args AuthBackendArgs, opts ...ResourceOption) (*AuthBackend, error)
    public AuthBackend(string name, AuthBackendArgs args, CustomResourceOptions? opts = null)
    public AuthBackend(String name, AuthBackendArgs args)
public AuthBackend(String name, AuthBackendArgs args, CustomResourceOptions options)

    type: vault:radius:AuthBackend
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_radius_auth_backend" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AuthBackendArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AuthBackendArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AuthBackendArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AuthBackendArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AuthBackendArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var exampleauthBackendResourceResourceFromRadiusauthBackend = new Vault.Radius.AuthBackend("exampleauthBackendResourceResourceFromRadiusauthBackend", new()
{
    SecretWo = "string",
    SecretWoVersion = 0,
    Host = "string",
    Mount = "string",
    TokenBoundCidrs = new[]
    {
        "string",
    },
    TokenExplicitMaxTtl = 0,
    Port = 0,
    ReadTimeout = 0,
    Namespace = "string",
    DialTimeout = 0,
    AliasMetadata = 
    {
        { "string", "string" },
    },
    NasPort = 0,
    TokenMaxTtl = 0,
    TokenNoDefaultPolicy = false,
    TokenNumUses = 0,
    TokenPeriod = 0,
    TokenPolicies = new[]
    {
        "string",
    },
    TokenTtl = 0,
    TokenType = "string",
    UnregisteredUserPolicies = new[]
    {
        "string",
    },
});

    example, err := radius.NewAuthBackend(ctx, "exampleauthBackendResourceResourceFromRadiusauthBackend", &radius.AuthBackendArgs{
	SecretWo:        pulumi.String("string"),
	SecretWoVersion: pulumi.Int(0),
	Host:            pulumi.String("string"),
	Mount:           pulumi.String("string"),
	TokenBoundCidrs: pulumi.StringArray{
		pulumi.String("string"),
	},
	TokenExplicitMaxTtl: pulumi.Int(0),
	Port:                pulumi.Int(0),
	ReadTimeout:         pulumi.Int(0),
	Namespace:           pulumi.String("string"),
	DialTimeout:         pulumi.Int(0),
	AliasMetadata: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	NasPort:              pulumi.Int(0),
	TokenMaxTtl:          pulumi.Int(0),
	TokenNoDefaultPolicy: pulumi.Bool(false),
	TokenNumUses:         pulumi.Int(0),
	TokenPeriod:          pulumi.Int(0),
	TokenPolicies: pulumi.StringArray{
		pulumi.String("string"),
	},
	TokenTtl:  pulumi.Int(0),
	TokenType: pulumi.String("string"),
	UnregisteredUserPolicies: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "vault_radius_auth_backend" "exampleauthBackendResourceResourceFromRadiusauthBackend" {
  lifecycle {
    create_before_destroy = true
  }
  secret_wo              = "string"
  secret_wo_version      = 0
  host                   = "string"
  mount                  = "string"
  token_bound_cidrs      = ["string"]
  token_explicit_max_ttl = 0
  port                   = 0
  read_timeout           = 0
  namespace              = "string"
  dial_timeout           = 0
  alias_metadata = {
    "string" = "string"
  }
  nas_port                   = 0
  token_max_ttl              = 0
  token_no_default_policy    = false
  token_num_uses             = 0
  token_period               = 0
  token_policies             = ["string"]
  token_ttl                  = 0
  token_type                 = "string"
  unregistered_user_policies = ["string"]
}

    var exampleauthBackendResourceResourceFromRadiusauthBackend = new com.pulumi.vault.radius.AuthBackend("exampleauthBackendResourceResourceFromRadiusauthBackend", com.pulumi.vault.radius.AuthBackendArgs.builder()
    .secretWo("string")
    .secretWoVersion(0)
    .host("string")
    .mount("string")
    .tokenBoundCidrs("string")
    .tokenExplicitMaxTtl(0)
    .port(0)
    .readTimeout(0)
    .namespace("string")
    .dialTimeout(0)
    .aliasMetadata(Map.of("string", "string"))
    .nasPort(0)
    .tokenMaxTtl(0)
    .tokenNoDefaultPolicy(false)
    .tokenNumUses(0)
    .tokenPeriod(0)
    .tokenPolicies("string")
    .tokenTtl(0)
    .tokenType("string")
    .unregisteredUserPolicies("string")
    .build());

    exampleauth_backend_resource_resource_from_radiusauth_backend = vault.radius.AuthBackend("exampleauthBackendResourceResourceFromRadiusauthBackend",
    secret_wo="string",
    secret_wo_version=0,
    host="string",
    mount="string",
    token_bound_cidrs=["string"],
    token_explicit_max_ttl=0,
    port=0,
    read_timeout=0,
    namespace="string",
    dial_timeout=0,
    alias_metadata={
        "string": "string",
    },
    nas_port=0,
    token_max_ttl=0,
    token_no_default_policy=False,
    token_num_uses=0,
    token_period=0,
    token_policies=["string"],
    token_ttl=0,
    token_type="string",
    unregistered_user_policies=["string"])

    const exampleauthBackendResourceResourceFromRadiusauthBackend = new vault.radius.AuthBackend("exampleauthBackendResourceResourceFromRadiusauthBackend", {
    secretWo: "string",
    secretWoVersion: 0,
    host: "string",
    mount: "string",
    tokenBoundCidrs: ["string"],
    tokenExplicitMaxTtl: 0,
    port: 0,
    readTimeout: 0,
    namespace: "string",
    dialTimeout: 0,
    aliasMetadata: {
        string: "string",
    },
    nasPort: 0,
    tokenMaxTtl: 0,
    tokenNoDefaultPolicy: false,
    tokenNumUses: 0,
    tokenPeriod: 0,
    tokenPolicies: ["string"],
    tokenTtl: 0,
    tokenType: "string",
    unregisteredUserPolicies: ["string"],
});

    type: vault:radius:AuthBackend
properties:
    aliasMetadata:
        string: string
    dialTimeout: 0
    host: string
    mount: string
    namespace: string
    nasPort: 0
    port: 0
    readTimeout: 0
    secretWo: string
    secretWoVersion: 0
    tokenBoundCidrs:
        - string
    tokenExplicitMaxTtl: 0
    tokenMaxTtl: 0
    tokenNoDefaultPolicy: false
    tokenNumUses: 0
    tokenPeriod: 0
    tokenPolicies:
        - string
    tokenTtl: 0
    tokenType: string
    unregisteredUserPolicies:
        - string

    AuthBackend Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AuthBackend resource accepts the following input properties:

    Host string
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    Mount string
    Path of the enabled RADIUS auth backend mount to configure.
    SecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    SecretWoVersion int
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    AliasMetadata Dictionary<string, string>
    A map of string to string that will be set as metadata on the identity alias
    DialTimeout int
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    Namespace string
    Target namespace. (requires Enterprise)
    NasPort int
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    Port int
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    ReadTimeout int
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    TokenBoundCidrs List<string>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    TokenExplicitMaxTtl int
    Generated Token's Explicit Maximum TTL in seconds
    TokenMaxTtl int
    The maximum lifetime of the generated token
    TokenNoDefaultPolicy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    TokenNumUses int
    The maximum number of times a token may be used, a value of zero means unlimited
    TokenPeriod int
    Generated Token's Period
    TokenPolicies List<string>
    Generated Token's Policies
    TokenTtl int
    The initial ttl of the token to generate in seconds
    TokenType string
    The type of token to generate, service or batch
    UnregisteredUserPolicies List<string>
    A set of policies to be granted to unregistered users.
    Host string
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    Mount string
    Path of the enabled RADIUS auth backend mount to configure.
    SecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    SecretWoVersion int
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    AliasMetadata map[string]string
    A map of string to string that will be set as metadata on the identity alias
    DialTimeout int
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    Namespace string
    Target namespace. (requires Enterprise)
    NasPort int
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    Port int
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    ReadTimeout int
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    TokenBoundCidrs []string
    Specifies the blocks of IP addresses which are allowed to use the generated token
    TokenExplicitMaxTtl int
    Generated Token's Explicit Maximum TTL in seconds
    TokenMaxTtl int
    The maximum lifetime of the generated token
    TokenNoDefaultPolicy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    TokenNumUses int
    The maximum number of times a token may be used, a value of zero means unlimited
    TokenPeriod int
    Generated Token's Period
    TokenPolicies []string
    Generated Token's Policies
    TokenTtl int
    The initial ttl of the token to generate in seconds
    TokenType string
    The type of token to generate, service or batch
    UnregisteredUserPolicies []string
    A set of policies to be granted to unregistered users.
    host string
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount string
    Path of the enabled RADIUS auth backend mount to configure.
    secret_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secret_wo_version number
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    alias_metadata map(string)
    A map of string to string that will be set as metadata on the identity alias
    dial_timeout number
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    namespace string
    Target namespace. (requires Enterprise)
    nas_port number
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port number
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    read_timeout number
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    token_bound_cidrs list(string)
    Specifies the blocks of IP addresses which are allowed to use the generated token
    token_explicit_max_ttl number
    Generated Token's Explicit Maximum TTL in seconds
    token_max_ttl number
    The maximum lifetime of the generated token
    token_no_default_policy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    token_num_uses number
    The maximum number of times a token may be used, a value of zero means unlimited
    token_period number
    Generated Token's Period
    token_policies list(string)
    Generated Token's Policies
    token_ttl number
    The initial ttl of the token to generate in seconds
    token_type string
    The type of token to generate, service or batch
    unregistered_user_policies list(string)
    A set of policies to be granted to unregistered users.
    host String
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount String
    Path of the enabled RADIUS auth backend mount to configure.
    secretWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secretWoVersion Integer
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    aliasMetadata Map<String,String>
    A map of string to string that will be set as metadata on the identity alias
    dialTimeout Integer
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    namespace String
    Target namespace. (requires Enterprise)
    nasPort Integer
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port Integer
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    readTimeout Integer
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    tokenBoundCidrs List<String>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl Integer
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl Integer
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy Boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses Integer
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod Integer
    Generated Token's Period
    tokenPolicies List<String>
    Generated Token's Policies
    tokenTtl Integer
    The initial ttl of the token to generate in seconds
    tokenType String
    The type of token to generate, service or batch
    unregisteredUserPolicies List<String>
    A set of policies to be granted to unregistered users.
    host string
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount string
    Path of the enabled RADIUS auth backend mount to configure.
    secretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secretWoVersion number
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    aliasMetadata {[key: string]: string}
    A map of string to string that will be set as metadata on the identity alias
    dialTimeout number
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    namespace string
    Target namespace. (requires Enterprise)
    nasPort number
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port number
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    readTimeout number
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    tokenBoundCidrs string[]
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl number
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl number
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses number
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod number
    Generated Token's Period
    tokenPolicies string[]
    Generated Token's Policies
    tokenTtl number
    The initial ttl of the token to generate in seconds
    tokenType string
    The type of token to generate, service or batch
    unregisteredUserPolicies string[]
    A set of policies to be granted to unregistered users.
    host str
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount str
    Path of the enabled RADIUS auth backend mount to configure.
    secret_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secret_wo_version int
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    alias_metadata Mapping[str, str]
    A map of string to string that will be set as metadata on the identity alias
    dial_timeout int
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    namespace str
    Target namespace. (requires Enterprise)
    nas_port int
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port int
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    read_timeout int
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    token_bound_cidrs Sequence[str]
    Specifies the blocks of IP addresses which are allowed to use the generated token
    token_explicit_max_ttl int
    Generated Token's Explicit Maximum TTL in seconds
    token_max_ttl int
    The maximum lifetime of the generated token
    token_no_default_policy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    token_num_uses int
    The maximum number of times a token may be used, a value of zero means unlimited
    token_period int
    Generated Token's Period
    token_policies Sequence[str]
    Generated Token's Policies
    token_ttl int
    The initial ttl of the token to generate in seconds
    token_type str
    The type of token to generate, service or batch
    unregistered_user_policies Sequence[str]
    A set of policies to be granted to unregistered users.
    host String
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount String
    Path of the enabled RADIUS auth backend mount to configure.
    secretWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secretWoVersion Number
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    aliasMetadata Map<String>
    A map of string to string that will be set as metadata on the identity alias
    dialTimeout Number
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    namespace String
    Target namespace. (requires Enterprise)
    nasPort Number
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port Number
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    readTimeout Number
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    tokenBoundCidrs List<String>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl Number
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl Number
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy Boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses Number
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod Number
    Generated Token's Period
    tokenPolicies List<String>
    Generated Token's Policies
    tokenTtl Number
    The initial ttl of the token to generate in seconds
    tokenType String
    The type of token to generate, service or batch
    unregisteredUserPolicies List<String>
    A set of policies to be granted to unregistered users.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AuthBackend resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    NasIdentifier string
    The NAS identifier field for the RADIUS authentication.
    Id string
    The provider-assigned unique ID for this managed resource.
    NasIdentifier string
    The NAS identifier field for the RADIUS authentication.
    id string
    The provider-assigned unique ID for this managed resource.
    nas_identifier string
    The NAS identifier field for the RADIUS authentication.
    id String
    The provider-assigned unique ID for this managed resource.
    nasIdentifier String
    The NAS identifier field for the RADIUS authentication.
    id string
    The provider-assigned unique ID for this managed resource.
    nasIdentifier string
    The NAS identifier field for the RADIUS authentication.
    id str
    The provider-assigned unique ID for this managed resource.
    nas_identifier str
    The NAS identifier field for the RADIUS authentication.
    id String
    The provider-assigned unique ID for this managed resource.
    nasIdentifier String
    The NAS identifier field for the RADIUS authentication.

    Look up Existing AuthBackend Resource

    Get an existing AuthBackend resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AuthBackendState, opts?: CustomResourceOptions): AuthBackend
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        alias_metadata: Optional[Mapping[str, str]] = None,
        dial_timeout: Optional[int] = None,
        host: Optional[str] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        nas_identifier: Optional[str] = None,
        nas_port: Optional[int] = None,
        port: Optional[int] = None,
        read_timeout: Optional[int] = None,
        secret_wo: Optional[str] = None,
        secret_wo_version: Optional[int] = None,
        token_bound_cidrs: Optional[Sequence[str]] = None,
        token_explicit_max_ttl: Optional[int] = None,
        token_max_ttl: Optional[int] = None,
        token_no_default_policy: Optional[bool] = None,
        token_num_uses: Optional[int] = None,
        token_period: Optional[int] = None,
        token_policies: Optional[Sequence[str]] = None,
        token_ttl: Optional[int] = None,
        token_type: Optional[str] = None,
        unregistered_user_policies: Optional[Sequence[str]] = None) -> AuthBackend
    func GetAuthBackend(ctx *Context, name string, id IDInput, state *AuthBackendState, opts ...ResourceOption) (*AuthBackend, error)
    public static AuthBackend Get(string name, Input<string> id, AuthBackendState? state, CustomResourceOptions? opts = null)
    public static AuthBackend get(String name, Output<String> id, AuthBackendState state, CustomResourceOptions options)
    resources:  _:    type: vault:radius:AuthBackend    get:      id: ${id}
    import {
  to = vault_radius_auth_backend.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AliasMetadata Dictionary<string, string>
    A map of string to string that will be set as metadata on the identity alias
    DialTimeout int
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    Host string
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    Mount string
    Path of the enabled RADIUS auth backend mount to configure.
    Namespace string
    Target namespace. (requires Enterprise)
    NasIdentifier string
    The NAS identifier field for the RADIUS authentication.
    NasPort int
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    Port int
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    ReadTimeout int
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    SecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    SecretWoVersion int
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    TokenBoundCidrs List<string>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    TokenExplicitMaxTtl int
    Generated Token's Explicit Maximum TTL in seconds
    TokenMaxTtl int
    The maximum lifetime of the generated token
    TokenNoDefaultPolicy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    TokenNumUses int
    The maximum number of times a token may be used, a value of zero means unlimited
    TokenPeriod int
    Generated Token's Period
    TokenPolicies List<string>
    Generated Token's Policies
    TokenTtl int
    The initial ttl of the token to generate in seconds
    TokenType string
    The type of token to generate, service or batch
    UnregisteredUserPolicies List<string>
    A set of policies to be granted to unregistered users.
    AliasMetadata map[string]string
    A map of string to string that will be set as metadata on the identity alias
    DialTimeout int
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    Host string
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    Mount string
    Path of the enabled RADIUS auth backend mount to configure.
    Namespace string
    Target namespace. (requires Enterprise)
    NasIdentifier string
    The NAS identifier field for the RADIUS authentication.
    NasPort int
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    Port int
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    ReadTimeout int
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    SecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    SecretWoVersion int
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    TokenBoundCidrs []string
    Specifies the blocks of IP addresses which are allowed to use the generated token
    TokenExplicitMaxTtl int
    Generated Token's Explicit Maximum TTL in seconds
    TokenMaxTtl int
    The maximum lifetime of the generated token
    TokenNoDefaultPolicy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    TokenNumUses int
    The maximum number of times a token may be used, a value of zero means unlimited
    TokenPeriod int
    Generated Token's Period
    TokenPolicies []string
    Generated Token's Policies
    TokenTtl int
    The initial ttl of the token to generate in seconds
    TokenType string
    The type of token to generate, service or batch
    UnregisteredUserPolicies []string
    A set of policies to be granted to unregistered users.
    alias_metadata map(string)
    A map of string to string that will be set as metadata on the identity alias
    dial_timeout number
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    host string
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount string
    Path of the enabled RADIUS auth backend mount to configure.
    namespace string
    Target namespace. (requires Enterprise)
    nas_identifier string
    The NAS identifier field for the RADIUS authentication.
    nas_port number
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port number
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    read_timeout number
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    secret_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secret_wo_version number
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    token_bound_cidrs list(string)
    Specifies the blocks of IP addresses which are allowed to use the generated token
    token_explicit_max_ttl number
    Generated Token's Explicit Maximum TTL in seconds
    token_max_ttl number
    The maximum lifetime of the generated token
    token_no_default_policy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    token_num_uses number
    The maximum number of times a token may be used, a value of zero means unlimited
    token_period number
    Generated Token's Period
    token_policies list(string)
    Generated Token's Policies
    token_ttl number
    The initial ttl of the token to generate in seconds
    token_type string
    The type of token to generate, service or batch
    unregistered_user_policies list(string)
    A set of policies to be granted to unregistered users.
    aliasMetadata Map<String,String>
    A map of string to string that will be set as metadata on the identity alias
    dialTimeout Integer
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    host String
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount String
    Path of the enabled RADIUS auth backend mount to configure.
    namespace String
    Target namespace. (requires Enterprise)
    nasIdentifier String
    The NAS identifier field for the RADIUS authentication.
    nasPort Integer
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port Integer
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    readTimeout Integer
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    secretWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secretWoVersion Integer
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    tokenBoundCidrs List<String>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl Integer
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl Integer
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy Boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses Integer
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod Integer
    Generated Token's Period
    tokenPolicies List<String>
    Generated Token's Policies
    tokenTtl Integer
    The initial ttl of the token to generate in seconds
    tokenType String
    The type of token to generate, service or batch
    unregisteredUserPolicies List<String>
    A set of policies to be granted to unregistered users.
    aliasMetadata {[key: string]: string}
    A map of string to string that will be set as metadata on the identity alias
    dialTimeout number
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    host string
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount string
    Path of the enabled RADIUS auth backend mount to configure.
    namespace string
    Target namespace. (requires Enterprise)
    nasIdentifier string
    The NAS identifier field for the RADIUS authentication.
    nasPort number
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port number
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    readTimeout number
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    secretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secretWoVersion number
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    tokenBoundCidrs string[]
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl number
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl number
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses number
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod number
    Generated Token's Period
    tokenPolicies string[]
    Generated Token's Policies
    tokenTtl number
    The initial ttl of the token to generate in seconds
    tokenType string
    The type of token to generate, service or batch
    unregisteredUserPolicies string[]
    A set of policies to be granted to unregistered users.
    alias_metadata Mapping[str, str]
    A map of string to string that will be set as metadata on the identity alias
    dial_timeout int
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    host str
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount str
    Path of the enabled RADIUS auth backend mount to configure.
    namespace str
    Target namespace. (requires Enterprise)
    nas_identifier str
    The NAS identifier field for the RADIUS authentication.
    nas_port int
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port int
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    read_timeout int
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    secret_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secret_wo_version int
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    token_bound_cidrs Sequence[str]
    Specifies the blocks of IP addresses which are allowed to use the generated token
    token_explicit_max_ttl int
    Generated Token's Explicit Maximum TTL in seconds
    token_max_ttl int
    The maximum lifetime of the generated token
    token_no_default_policy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    token_num_uses int
    The maximum number of times a token may be used, a value of zero means unlimited
    token_period int
    Generated Token's Period
    token_policies Sequence[str]
    Generated Token's Policies
    token_ttl int
    The initial ttl of the token to generate in seconds
    token_type str
    The type of token to generate, service or batch
    unregistered_user_policies Sequence[str]
    A set of policies to be granted to unregistered users.
    aliasMetadata Map<String>
    A map of string to string that will be set as metadata on the identity alias
    dialTimeout Number
    Number of seconds to wait for a backend connection before timing out. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    host String
    The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1.
    mount String
    Path of the enabled RADIUS auth backend mount to configure.
    namespace String
    Target namespace. (requires Enterprise)
    nasIdentifier String
    The NAS identifier field for the RADIUS authentication.
    nasPort Number
    The NAS-Port attribute of the RADIUS request. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    port Number
    The UDP port where the RADIUS server is listening on. Defaults to 1812.
    readTimeout Number
    Number of seconds to wait for a response from the RADIUS server. Defaults to 10. If removed from configuration after being set, Vault retains the previously stored value.
    secretWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The RADIUS shared secret. This is a write-only field and will not be read back from Vault.
    secretWoVersion Number
    Version counter for the write-only secretWo field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update secretWo so Terraform detects the change and applies an update.
    tokenBoundCidrs List<String>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl Number
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl Number
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy Boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses Number
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod Number
    Generated Token's Period
    tokenPolicies List<String>
    Generated Token's Policies
    tokenTtl Number
    The initial ttl of the token to generate in seconds
    tokenType String
    The type of token to generate, service or batch
    unregisteredUserPolicies List<String>
    A set of policies to be granted to unregistered users.

    Import

    RADIUS auth backend configurations can be imported using the full config API path:

    $ pulumi import vault:radius/authBackend:AuthBackend example auth/radius/config
$ pulumi import vault:radius/authBackend:AuthBackend example auth/my-radius/config

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial