Configure properties

You can override RADIUS Agent default properties as required.

  1. Open /opt/okta/ragent/user/config/radius/config.properties.
  2. Configure the properties, as required.
    Property Description Default
    ragent.num_max_http_connection The maximum number of HTTP connections in the connection pool. 20*
    ragent.num_request_threads The number of authentication worker threads available for processing requests. 15*
    ragent.total.request.timeout.millisecond The maximum time the RADIUS agent is allowed to process a UDP packet after it has arrived from the RADIUS client.

    For the Okta Verify with Push factor, the actual value is interpreted by the RADIUS agent as one half (1/2) of the configured value.

    For example: 60000 = 60 seconds, divided in half = 30 seconds.

    For all other factors the value is used as specified.

    		 60000
    ragent.request.timeout.millisecond The maximum time the RADIUS agent is allowed to process a UDP packet after it has arrived from the RADIUS client.

    If specified, ragent.total.request.timeout.millisecond is ignored.

    If not specified, the default is to use ragent.total.request.timeout.millisecond.

    Available since version 2.9.4.

    		 N/A defaults to value specified by ragent.total.request.timeout.millisecond
    ragent.okta.request.max.timeout.millisecond The socket timeout to set on the Okta API request. This property only applies if configured; otherwise, it is computed dynamically based on the total request timeout setting. Dynamic, based on remaining TTL for request
    ragent.request.timeout.response.mode The timeout response mode. Possible values include:
    • SEND_REJECT_ALWAYS: agent sends a reject message to the client after any timeout.
    • SEND_REJECT_ON_POLL_MFA: agent sends a reject message to the client if a timeout occurs during the MFA polling loop only (that is, while the agent is polling Okta to determine if the user has correctly responded to an MFA challenge such as a push notification). If a timeout occurs at any other time, no response will be sent to the client.
    • NO_RESPONSE: no response will be sent to the client when the agent times out.
    		 SEND_REJECT_ON_POLL_MFA
    ragent.mfa.timeout.seconds Time, in seconds, that the agent will wait for the client to respond to an MFA challenge such as factor selection. 60

    * If "Request queue is full" appears in your logs, the RADIUS Server Agent is rejecting login attempts due to reaching the maximum number of threads and connections that it can process. See Request queue is full.

    The following properties apply to proxy configuration only:

    Property Description Default
    ragent.proxy.enabled Indicates whether the RADIUS agent should use a proxy. Set to true. For example, 
    ragent.proxy.enabled = true
    		 Not present. Add this property to config.properties.
    ragent.proxy.address The IP address (and port, if required), of the proxy. This property must exist when ragent.proxy.enabled is true. For example,
    ragent.proxy.address = 127.0.0.1:8888

    Not present. Add this property to config.properties.
    ragent.ssl.pinning If the proxy terminates the SSL connection, disable SSL pinning. For example, 
    ragent.ssl.pinning = false
    		 true
    ragent.proxy.user

    ragent.proxy.password

    		Proxy credentials, if required. Encrypted on agent restart. For example, 
    ragent.proxy.user = admin
    ragent.proxy.password = password
    		 Not present. Add this property to config.properties.
  3. Save the file. Any changes are effective after restarting the Okta RADIUS Agent service as described in Manage the agent.

Next steps

Manage the agent