radcli_aaa(3)

📦 version 2.0.1, in arch rolling

✨ NAME ✨

okay so bestie, this is radcli_aaa(3) from the Radius client library, and its whole thing is: perform an authentication or accounting exchange with Acct-Delay-Time autofill and fail-over across every configured server. 💅✨

🌸 SYNOPSIS 🌸

#include <radcli/>

int radcli_aaa(
    radcli_ctx             *ctx,
    radcli_code             code,
    const radcli_avp_list  *send,
    radcli_code            *out_code,
    radcli_avp_list       **out_attrs
);

🦋 DESCRIPTION 🦋

So here’s the tea: this is the new API’s counterpart to radcli.h’s rc_aaa()/rc_auth()/rc_acct(), layered on top of the single-server radcli_request_new()/_perform() building block the same way lib/aaa_ctx.c layers over rc_auth() today. It’s added as a separate wrapper rather than as an extension of radcli_request_perform(), so that function’s single-server contract is untouched. Periodt. 💖

Unlike radcli_request_new(), which uses only the first configured "authserver"/"acctserver" entry (REQ-NET2-INIT-003), this one tries every configured entry in order and moves to the next on a timeout or unreachable-network result — exactly as rc_aaa()/rc_aaa_ctx() do. No cap, it really does go down the whole list. 🔥

Unlike the legacy rc_aaa(), this has no NAS-Port autofill parameters. NAS-Port is a value the caller already knows before calling, exactly like any other attribute (NAS-IP-Address, Called-Station-Id, ...), so it belongs in send via radcli_avp_add_uint32_by_num(), not as a special-cased parameter here. Lowkey cleaner that way. 🧚

Acct-Delay-Time remains the one attribute radcli_aaa() computes itself, since only it can see the fail-over timing. If code is #RADCLI_CODE_ACCOUNTING_REQUEST, an Acct-Delay-Time attribute is always added (replacing any in send), measuring elapsed time from the first attempt, continuing to accumulate across a fail-over retry rather than resetting, and folding in any Acct-Delay-Time already in send as an initial offset — matching rc_fill_acct_pairs()’s (lib/buildreq.c) semantics. The way it keeps the clock running across retries? Obsessed. ⏱️💫

👑 PARAMETERS 👑

  • ctx — a context with configuration loaded. Gotta have it, bestie. 🫶
  • code — RADCLI_CODE_ACCESS_REQUEST or RADCLI_CODE_ACCOUNTING_REQUEST. Pick your main-character request type. ✨
  • send — the attributes to send; copied in per attempt, so send may be freed or reused by the caller immediately after this call returns. No lingering attachment, fr fr. 💅
  • out_code — if non-NULL, receives the final reply’s RADIUS code on RADCLI_OK. It’s giving “here’s the verdict.” 🎀
  • out_attrs — if non-NULL, receives the final reply’s decoded attributes on RADCLI_OK (owned by the caller, free with radcli_avp_list_free()); left unset otherwise. Pass NULL for an Accounting-Request caller uninterested in the (typically empty) reply. You’re so independent. 💜

🌈 RETURN VALUE 🌈

  • RADCLI_OK if any configured server produced a validated reply (check out_code for Access-Accept/Access-Reject/Access-Challenge). Slay. 🔥
  • RADCLI_TIMEOUT if no server produced one and the last server tried timed out. Sad but at least we know. 😭
  • RADCLI_ERROR on failure (NULL ctx/send, an invalid code, no server configured for that code’s type, an allocation/encoding failure, or the last server tried being on an unreachable network). Big yikes, but listed. 💀

🐚 SEE ALSO 🐚

go read these next, bestie:

signed, sealed, delivered with love: radcli 🫶 — 2026-10-10 💖

📦 where this page comes from