radcli_aaa(3) Radius client library radcli_aaa(3)

radcli_aaa - Perform an authentication or accounting exchange with Acct-Delay-Time autofill and fail-over across every configured server.

#include <radcli/>

int radcli_aaa(
    radcli_ctx             *ctx,
    radcli_code             code,
    const radcli_avp_list  *send,
    radcli_code            *out_code,
    radcli_avp_list       **out_attrs
);

The new API's counterpart to radcli.h's rc_aaa()/rc_auth()/rc_acct(), layered on top of the single-server radcli_request_new()/_perform() building block the same way lib/aaa_ctx.c layers over rc_auth() today added as a separate wrapper rather than as an extension of radcli_request_perform(), so that function's single-server contract is untouched. Unlike radcli_request_new(), which uses only the first configured "authserver"/"acctserver" entry (REQ-NET2-INIT-003), this tries every configured entry in order, moving to the next on a timeout or unreachable-network result, exactly as rc_aaa()/rc_aaa_ctx() do.

Unlike the legacy rc_aaa(), this has no NAS-Port autofill parameters: NAS-Port is a value the caller already knows before calling, exactly like any other attribute (NAS-IP-Address, Called-Station-Id, ...), so it belongs in send via radcli_avp_add_uint32_by_num(), not as a special-cased parameter here. Acct-Delay-Time remains the one attribute radcli_aaa() computes itself, since only it can see the fail-over timing: if code is #RADCLI_CODE_ACCOUNTING_REQUEST, an Acct-Delay-Time attribute is always added (replacing any in send), measuring elapsed time from the first attempt continuing to accumulate across a fail-over retry, not resetting folding in any Acct-Delay-Time already in send as an initial offset, matching rc_fill_acct_pairs()'s (lib/buildreq.c) semantics.

a context with configuration loaded.
RADCLI_CODE_ACCESS_REQUEST or RADCLI_CODE_ACCOUNTING_REQUEST.
the attributes to send; copied in per attempt send may be freed or reused by the caller immediately after this call returns.
if non-NULL, receives the final reply's RADIUS code on RADCLI_OK.
if non-NULL, receives the final reply's decoded attributes on RADCLI_OK (owned by the caller, free with radcli_avp_list_free()); left unset otherwise. Pass NULL for an Accounting-Request caller uninterested in the (typically empty) reply.

RADCLI_OK if any configured server produced a validated reply (check out_code for Access-Accept/Access-Reject/Access-Challenge), RADCLI_TIMEOUT if every configured server timed out or was unreachable, RADCLI_ERROR on failure (NULL ctx/send, an invalid code, no server configured for that code's type, or an allocation/encoding failure).

radcli_request_attrs(3), radcli_request_code(3), radcli_request_done(3), radcli_request_free(3), radcli_request_new(3), radcli_request_perform(3), radcli_request_server(3)

2026-09-03 radcli