Secure every access request.
Automate every policy decision.

// PolicyLogic: evaluated per RADIUS request function onAuth() { // 1. Load Entra ID credentials from Vault const auth = new EntraIDAuth({ client_id: Vault.read("entraid-clientid"), tenant_id: Vault.read("entraid-tenantid"), client_secret: Vault.read("entraid-key") }); // 2. Enforce Entra ID lifecycle (block disabled/expired users) if (!auth.checkUser(radius.request['User-Name'])) { radius.reply['Reply-Message'] = "Account disabled or not found in Entra ID"; return fail(); } // 3. Assign VLAN by SSID / Called-Station-Id const ssid = radius.request['Called-Station-Id']; if (ssid === "guest-wifi") { return vlan(110, "Guest Wi-Fi"); } // 4. Default: department VLAN from Entra ID attribute return vlan(auth.user.departmentVlan, auth.user.department); } // Helper: return standard RADIUS tunnel attributes function vlan(id, label) { radius.reply['Tunnel-Private-Group-Id'] = String(id); radius.reply['Tunnel-Type'] = "VLAN"; radius.reply['Tunnel-Medium-Type'] = "IEEE-802"; // Optional: log for audit // log.info(`VLAN ${id} (${label}) assigned to ${radius.request['User-Name']}`); return success(); }