apereo/cas · warning

failoverOnException enabled -- trying next server.

Error message

failoverOnException enabled -- trying next server.

What it means

RadiusUtils.authenticate iterates over configured RADIUS servers. When a server throws an unexpected exception (network error, malformed response) and failoverOnException is enabled, the exception is swallowed with this warning and the next server is tried. If all servers fail, the method returns false with an empty response.

Solutions

1. Fix the underlying RADIUS server error reported in the attached exception stack trace (host, port, shared secret).
2. Ensure at least one RADIUS server in the failover list is healthy so authentication can succeed.
3. If you'd rather fail fast and surface errors, set failoverOnException=false.
4. Verify network connectivity (UDP/1812) from the CAS host to each RADIUS server.

Example fix

# before — every server fails silently
cas.authn.radius.client.server[0].address=10.0.0.1:1812
cas.authn.radius.client.server[1].address=10.0.0.2:1812
# after — point at reachable servers and test connectivity
cas.authn.radius.client.server[0].address=10.0.0.10:1812  # verify: nc -u -z 10.0.0.10 1812

nc -u -z radius01.example.org 1812 || echo 'RADIUS server unreachable'

if (!authResult) {
  // authenticate() returned Pair.of(false, empty) after all servers failed
  logger.error("RADIUS authentication failed across all configured servers");
}

When it happens

Trigger: A RADIUS server in the client list raises an exception during AccessRequest handling (timeout, connection reset, packet error) while the RadiusClient is configured with failoverOnException=true.

Common situations: Dead or unreachable secondary RADIUS servers; firewalls dropping UDP 1812 packets; wrong shared secrets causing protocol errors; mis-typed server addresses in cas.authn.radius.client.server settings.

Related errors

• Radius authentication failed
• not in allowed range.
• Unexpected LDAP error
• Failed to acquire access token
• Radius authentication failed for user

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/fca607a52205082d. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-radius-core/src/main/java/org/apereo/cas/adaptors/radius/RadiusUtils.java:58

            LOGGER.debug("Attempting to authenticate [{}] at [{}]", username, radiusServer);
            try {
                val response = radiusServer.authenticate(username, password, state);
                if (response != null) {
                    val attributes = response.attributes()
                        .stream()
                        .collect(Collectors.toMap(RadiusAttribute::getAttributeName, RadiusAttribute::getValue, (__, b) -> b, () -> new HashMap<String, Object>()));
                    return Pair.of(Boolean.TRUE, Optional.of(attributes));
                }

                if (!failoverOnAuthenticationFailure) {
                    throw new FailedLoginException("Radius authentication failed for user " + username);
                }
                LOGGER.debug("failoverOnAuthenticationFailure enabled -- trying next server");
            } catch (final Exception e) {
                if (!failoverOnException) {
                    throw e;
                }
                LoggingUtils.warn(LOGGER, "failoverOnException enabled -- trying next server.", e);
            }
        }
        return Pair.of(Boolean.FALSE, Optional.empty());
    }
}

View on GitHub (pinned to e7288fc434)