docs: update RADIUS Gateway Guide with missing features and fixes

- Update feature list with all features from releases v1.2 through v1.7.1
- Remove incorrect X-MSS-MSISDN VSA claim (not implemented in code)
- Add RADIUS client retry recommendation to NAS Requirements
- Add ldapsearch debugging command for LDAP troubleshooting
- Add Amazon ECR pull command and fix Docker Hub/ECR links
- Add RIG-specific radclient test examples to annexes

Author: phaupt

docs/radius-interface-gateway-guide/annexes.md

@@ -49,6 +49,31 @@ echo "User-Name=test,User-Password=mypass,Framed-Protocol=PPP" | \
 echo "Message-Authenticator = 0x00" | /usr/local/bin/radclient localhost:1812 auth s3cr3t
 ```
 
+#### Testing a RIG Instance
+
+The following examples show how to use `radclient` to test a running RIG instance specifically.
+
+**Without LDAP** — the MSISDN is provided as part of the User-Name:
+
+```bash
+echo "User-Name=<MyMobileNumber>@<mycompany.com>,NAS-Identifier=<ch_mycompany>" | \
+  radclient -c 1 -r 1 -x -t 30 <server-ip> auth <shared-secret>
+```
+
+**With LDAP** — the RIG service retrieves the user's mobile number via LDAP:
+
+```bash
+echo "User-Name=<username>,User-Password=<user-password>,NAS-Identifier=<ch_mycompany>" | \
+  radclient -c 1 -r 1 -x -t 30 <server-ip> auth <shared-secret>
+```
+
+**OTP (SMS) challenge-response** — if the authentication falls back to OTP via SMS, you will receive an `Access-Challenge` response that includes a `State` value. You must respond with another `Access-Request` that includes the OTP as `User-Password` and the retrieved `State` value:
+
+```bash
+echo "User-Name=<MyMobileNumber>@<mycompany.com>,User-Password=<otp>,State=<state>,NAS-Identifier=<ch_mycompany>" | \
+  radclient -c 1 -r 1 -x -t 30 <server-ip> auth <shared-secret>
+```
+
 ### RADIUS Online Test
 
 The idBlender company provides a free online web application that functions as a RADIUS client. It uses a backend service to perform the actual RADIUS request (so it is not the browser that sends the RADIUS requests, but a backend service) and can be used to test publicly available RADIUS servers.

docs/radius-interface-gateway-guide/deployment.md

@@ -28,6 +28,7 @@ The following points must be considered before you proceed with the deployment.
 
 - The NAS RADIUS Access-Request packet contains either a **unique NAS-Identifier attribute** or it has a **unique and static source IP address/range**. RIG will pick the configuration based on this info.
 - The RADIUS client timeout shall be set to **60 seconds**. This ensures enough time for the user to respond to the Mobile ID authentication request.
+- The RADIUS client retry shall be set to no more than **1**. The client should not retry because there might still be a Mobile ID authentication session ongoing.
 
 ### Connectivity Requirements
 
@@ -45,6 +46,16 @@ You can verify the LDAP connectivity using the following command on the node whe
 ldapwhoami -x -w <passwd> -D "cn=<tbd>,ou=<tbd>,dc=<tbd>,dc=<tbd>" -H ldap://<ldap.myserver.com>:389
 ```
 
+When troubleshooting LDAP configuration issues, you can use `ldapsearch` to query user attributes directly:
+
+```bash
+ldapsearch -LLL -H ldap://<ldap.myserver.com>:389 \
+  -b "ou=<tbd>,dc=<tbd>,dc=<tbd>" \
+  -D "cn=<admin>,dc=<tbd>,dc=<tbd>" \
+  -w <passwd> \
+  -s sub "(&(objectclass=inetOrgPerson)(uid=<user>))"
+```
+
 You can verify the Mobile ID API connectivity using the following command on the node where the RIG container application is running:
 
 ```bash
@@ -61,11 +72,11 @@ Here is an I18N Error Message JSON configuration example. Add the JSON content e
 
 ## Docker Run
 
-You can pull the Docker images from [Docker Hub](https://hub.docker.com/) (or alternatively from Amazon ECR).
+You can pull the Docker images from [Docker Hub](https://hub.docker.com/repository/docker/mobileidch/mid-radius-rig) or from [Amazon ECR](https://gallery.ecr.aws/mobileidch/mid-radius-rig).
 
 For high availability, you will need the following components, running at least two instances each:
 
-- **Mobile ID RADIUS Interface Gateway application** — [Docker Hub](https://hub.docker.com/) or Amazon ECR
+- **Mobile ID RADIUS Interface Gateway application** — [Docker Hub](https://hub.docker.com/repository/docker/mobileidch/mid-radius-rig) or [Amazon ECR](https://gallery.ecr.aws/mobileidch/mid-radius-rig)
 - **Redis database** using `redis` (requires 3 nodes for HA; alternatively, `keydb` may be used)
 - **Redis web management tool** using `redis-commander` to manage the Redis database content
 - **UDP network load balancer** using `nginx` with a custom `nginx.conf` configuration
@@ -76,6 +87,12 @@ How to pull an image from Docker Hub:
 docker pull mobileidch/mid-radius-rig
 ```
 
+How to pull an image from Amazon ECR:
+
+```bash
+docker pull public.ecr.aws/mobileidch/mid-radius-rig
+```
+
 How to run a Docker application:
 
 ```bash

docs/radius-interface-gateway-guide/introduction.md

@@ -10,11 +10,10 @@ During authentication via RADIUS, an extra step requires users to confirm the ac
 
 Some clients might decide to move from 1FA (one-factor authentication) to 2FA: username + password and Mobile ID. Other clients might decide to stick with 2FA but replace the existing combination of username + password and security device challenge with username + password plus Mobile ID as additional MFA.
 
-RADIUS users are typically defined in the format `user@domain`. However, Mobile ID requires the phone number (MSISDN) of the user. Therefore, the phone number of the target user should be provided with one of the following options (RIG supports all three):
+RADIUS users are typically defined in the format `user@domain`. However, Mobile ID requires the phone number (MSISDN) of the user. Therefore, the phone number of the target user should be provided with one of the following options:
 
 - RIG connects to a customer's **Directory Service (LDAP)** to retrieve user attributes such as phone number (MSISDN) or other optional attributes such as User-Language, MobileID serial number, or the user's preferred authentication method.
 - The RADIUS client provides the **MSISDN as part of the User-Name** (e.g. `4179xxxxxxx@mydomain.com`).
-- The RADIUS client provides the **MSISDN via Vendor Specific Attribute** (`X-MSS-MSISDN`).
 
 ## RIG Feature List
 
@@ -23,12 +22,24 @@ RADIUS users are typically defined in the format `user@domain`. However, Mobile
 - Multitenancy
 - Cloud-native microservice architecture (horizontal scalability)
 - Authentication: Mobile ID SIM, Mobile ID App, OTP Text SMS
-- Geofencing
-- LDAP lookup (`userPassword`, `mobile`, `preferredLanguage`, `midSerial`, `preferredMFA`)
+- Automatic authentication fallback with configurable priority
+- MFA method selection via LDAP group membership (`memberOf`)
+- MFA method "None" (temporarily disable MFA per user or group)
+- Geofencing (whitelist/blacklist configuration, AD group-based, configurable confidence scores)
+- LDAP(S) integration (`userPassword`, `mobile`, `preferredLanguage`, `midSerial`, `preferredMFA`)
+- LDAP search scope and referral configuration
+- Flexible LDAP search filters with multiple username placeholders
+- LDAP authentication without admin/service user
+- User Account Control attribute support
 - Mobile ID user's serial number validation (optional)
+- RADIUS Accounting
+- RADIUS Class attribute in Access-Accept
 - Custom RADIUS Reply Messages for Access-Reject
 - Custom Text SMS notification for specific error events
+- Accounting Webhook (forward accounting traffic to external systems)
 - Supports Fortinet Vendor Specific Attributes (VSA)
+- Support for Docker secrets via `_FILE` environment variables
+- BlastRADIUS mitigation — Message-Authenticator support (CVE-2024-3596)
 
 ### Features Planned