{"record":{"id":"276103580955079b","repo":"apereo/cas","slug":"radius-authentication-failed-e-message","errorCode":null,"errorMessage":"Radius authentication failed ${e.message}","messagePattern":"Radius authentication failed (.+?)","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-radius/src/main/java/org/apereo/cas/adaptors/radius/authentication/handler/support/RadiusAuthenticationHandler.java","lineNumber":66,"sourceCode":"\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,\n                                                                                        final String originalPassword) throws GeneralSecurityException {\n\n        try {\n            val username = credential.getUsername();\n            val result = RadiusUtils.authenticate(username, credential.toPassword(), this.servers,\n                this.failoverOnAuthenticationFailure, this.failoverOnException, Optional.empty());\n            if (result.getKey() && result.getValue().isPresent()) {\n                val attributes = CollectionUtils.toMultiValuedMap(result.getValue().get());\n                return createHandlerResult(credential,\n                    principalFactory.createPrincipal(username, attributes),\n                    new ArrayList<>());\n            }\n            throw new FailedLoginException(\"Radius authentication failed for user \" + username);\n        } catch (final Throwable e) {\n            LoggingUtils.error(LOGGER, e);\n            throw new FailedLoginException(\"Radius authentication failed \" + e.getMessage());\n        }\n    }\n}\n","sourceCodeStart":48,"sourceCodeEnd":70,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-radius/src/main/java/org/apereo/cas/adaptors/radius/authentication/handler/support/RadiusAuthenticationHandler.java#L48-L70","documentation":"The catch-all in RadiusAuthenticationHandler.authenticateUsernamePasswordInternal: any Throwable escaping the RADIUS exchange (network failure, protocol error, null response, etc.) is logged and rethrown as FailedLoginException('Radius authentication failed ' + cause message). The original exception type is lost, only its message survives.","triggerScenarios":"RadiusClient throws inside RadiusUtils (socket timeout, unknown host, shared-secret/encoding error, response parse issue) and failoverOnException is false, so the exception bubbles into this catch block and is converted to FailedLoginException with e.getMessage().","commonSituations":"RADIUS server down or firewalled (timeout); DNS failure for the RADIUS hostname; shared secret too short (RFC 2865 requires >=16 chars) causing client-side rejection; wrong port (1812 auth vs 1813 accounting).","solutions":["Read the logged cause (LoggingUtils.error output) and fix the underlying RADIUS connectivity/configuration","Check network reachability: telnet/nc to the RADIUS host and authentication port","Verify the shared secret length and exact match; verify port 1812 (auth) vs 1813 (acct)","Enable failoverOnException=true to fail over to other servers on exceptions"],"exampleFix":"// before (config)\n// cas.authn.radius.failover-exception=false\n// after\n// cas.authn.radius.failover-exception=true\n// and add a secondary server: cas.authn.radius.servers[1].address=radius2.example.com","handlingStrategy":"try-catch","validationCode":"// pre-check reachability before auth attempt\nnew Socket().connect(new InetSocketAddress(radiusHost, 1812), 3000);","typeGuard":null,"tryCatchPattern":"try {\n    authHandler.authenticate(credential);\n} catch (FailedLoginException e) {\n    if (e.getMessage() != null && !e.getMessage().isBlank()) {\n        // inspect embedded cause message: timeout / refused / secret\n    }\n}","preventionTips":["Monitor RADIUS host/port reachability","Use shared secrets >=16 characters","Use correct auth (1812) vs acct (1813) ports","Enable failoverOnException"],"tags":["radius","network","cas"],"backgroundTag":"http-request-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}