{"record":{"id":"2fe18a34b8d301e8","repo":"apereo/cas","slug":"radius-authentication-failed-for-user-username","errorCode":null,"errorMessage":"Radius authentication failed for user ${username}","messagePattern":"Radius authentication failed for user (.+?)","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-radius-mfa/src/main/java/org/apereo/cas/adaptors/radius/authentication/RadiusTokenAuthenticationHandler.java","lineNumber":91,"sourceCode":"\n        var state = Optional.empty();\n        val attributes = principal.getAttributes();\n        if (attributes.containsKey(Attr_State.NAME)) {\n            LOGGER.debug(\"Found state attribute in principal attributes for multifactor authentication\");\n            val stateValue = CollectionUtils.firstElement(attributes.get(Attr_State.NAME));\n            if (stateValue.isPresent()) {\n                val stateAttr = (AttributeValue) stateValue.get();\n                state = Optional.of(stateAttr.getValueObject());\n            }\n        }\n        val result = RadiusUtils.authenticate(username, password, this.servers,\n            failoverOnAuthenticationFailure, this.failoverOnException, state);\n        if (result.getKey()) {\n            val radiusAttributes = CollectionUtils.toMultiValuedMap(result.getValue().orElseThrow());\n            val finalPrincipal = principalFactory.createPrincipal(username, radiusAttributes);\n            return createHandlerResult(credential, finalPrincipal, new ArrayList<>());\n        }\n        throw new FailedLoginException(\"Radius authentication failed for user \" + username);\n    }\n}\n","sourceCodeStart":73,"sourceCodeEnd":94,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-radius-mfa/src/main/java/org/apereo/cas/adaptors/radius/authentication/RadiusTokenAuthenticationHandler.java#L73-L94","documentation":"RadiusTokenAuthenticationHandler.doAuthentication throws FailedLoginException when RadiusUtils.authenticateUsernamePassword returns success=false, meaning RADIUS rejected the credentials (and failover was disabled or exhausted). The username is interpolated into the message.","triggerScenarios":"MFA radius-token flow calls RadiusUtils with the OTP/username credentials; the resulting Pair key is false because all RADIUS servers rejected, and failoverOnAuthenticationFailure was false or all servers were tried.","commonSituations":"Invalid or expired OTP/token code; misconfigured RADIUS server credentials in the MFA radius settings; RADIUS server unreachable and failoverOnException=false path already handled; user account rejected by policy server.","solutions":["Confirm the token/OTP code is valid and not expired","Validate cas.authn.mfa.radius.* server settings (host, shared secret, port)","Enable failoverOnAuthenticationFailure/failoverOnException to retry alternate RADIUS servers","Check RADIUS server-side logs to distinguish bad code vs server policy reject"],"exampleFix":"// before\nthrow new FailedLoginException(\"Radius authentication failed for user \" + username);\n// after (config): cas.authn.mfa.radius.failover-authentication-failure=true\n// cas.authn.mfa.radius.failover-exception=true","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    handler.doAuthentication(credential);\n} catch (FailedLoginException e) {\n    // show 'invalid token code' message to the MFA user\n}","preventionTips":["Ensure OTP/token codes are validated client-side for format before submit","Keep failover configuration for MFA radius servers","Sync token seeds/clock if using token codes"],"tags":["radius","mfa","authentication","cas"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}