Authentication and Authorization

RADKit distinguishes multiple types of authentication:

  • User Authentication:

    • Admin Authentication: used by RADKit Service to authenticate RADKit administrators (e.g at the RADKit WebUI logon, or when using the control API).

    • Remote User Authentication: used by RADKit Service to authenticate remote users (e.g. users that want to access a device through RADKit).

  • Device Authentication: used by RADKit Service to authenticate to network devices.

In each case, the credentials used for authentication can be stored locally in the RADKit Service database, or they can be stored in an external system, such as a TACACS+ server or a secrets management system.

External sources

The external sources feature enables integration with third-party applications and services. It allows for the delegation of device authentication and/or administrative authentication, such as external secret storage or third-party admin authentication methods.

Not all external sources support all types of authentication. For example, an external source of type “OIDC” can only be used for Administrator authentication, while an external source of type “TACACS+” can be used for both Admin and Remote User authentication, but not for device authentication.

Warning

Currently, the configuration of external sources is exclusively available through the Service WebUI and is accessible solely to the superadmin user role. To manage external sources, navigate to the External Sources tab where you can add, edit, or remove configurations.

Administrator authentication

Administrators are authenticated to the RADKit Service when they log on to the WebUI or use the control API. The authentication of administrators can be performed locally by the RADKit Service, or it can be delegated to an external system, such as a TACACS+ or OIDC server.

At login time, the administrator is credited with an administrative role (e.g. basic-admin, sysadmin) that defines the permissions of the administrator in the RADKit Service. The role is determined by the RADKit Service based on the credentials provided by the administrator at login time, and the configuration of the RADKit Service administrator.

Remote users authentication

Remote users are authenticated to the RADKit Service when they want to access a device through RADKit. The authentication of remote users can be performed locally by the RADKit Service, or it can be delegated to an external system, such as a TACACS+ server.

Once the user is authenticated, the RADKit Service then authorizes access to various devices based on the permissions associated with the user. These permissions are defined through the RBAC Labels.

Device authentication

When RADKit Service connects to a device, it needs to authenticate to the device using credentials. The credentials used by RADKit Service to authenticate to devices can be stored in the RADKit database (along each device or shared across devices), or they can be stored in an external system, such as a secrets management system (Hashicorp, Cyberark,…).

In some cases, it is even possible for the RADKit Service to select devices credentials based on the identity of the remote user.

Next up

In the following sections, we will describe the different authentication methods available for each type of authentication, and how to set them up.