{"record":{"id":"504c36cf5ad5b295","repo":"apereo/cas","slug":"radius-authentication-failed-for-user","errorCode":null,"errorMessage":"Radius authentication failed for user ","messagePattern":"Radius authentication failed for user ","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-radius-core/src/main/java/org/apereo/cas/adaptors/radius/RadiusUtils.java","lineNumber":51,"sourceCode":"    public static Pair<Boolean, Optional<Map<String, Object>>> authenticate(final String username,\n                                                                            final String password,\n                                                                            final List<RadiusServer> servers,\n                                                                            final boolean failoverOnAuthenticationFailure,\n                                                                            final boolean failoverOnException,\n                                                                            final Optional state) throws Exception {\n        for (val radiusServer : servers) {\n            LOGGER.debug(\"Attempting to authenticate [{}] at [{}]\", username, radiusServer);\n            try {\n                val response = radiusServer.authenticate(username, password, state);\n                if (response != null) {\n                    val attributes = response.attributes()\n                        .stream()\n                        .collect(Collectors.toMap(RadiusAttribute::getAttributeName, RadiusAttribute::getValue, (__, b) -> b, () -> new HashMap<String, Object>()));\n                    return Pair.of(Boolean.TRUE, Optional.of(attributes));\n                }\n\n                if (!failoverOnAuthenticationFailure) {\n                    throw new FailedLoginException(\"Radius authentication failed for user \" + username);\n                }\n                LOGGER.debug(\"failoverOnAuthenticationFailure enabled -- trying next server\");\n            } catch (final Exception e) {\n                if (!failoverOnException) {\n                    throw e;\n                }\n                LoggingUtils.warn(LOGGER, \"failoverOnException enabled -- trying next server.\", e);\n            }\n        }\n        return Pair.of(Boolean.FALSE, Optional.empty());\n    }\n}\n","sourceCodeStart":33,"sourceCodeEnd":64,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-radius-core/src/main/java/org/apereo/cas/adaptors/radius/RadiusUtils.java#L33-L64","documentation":"RadiusUtils.authenticateUsernamePassword throws FailedLoginException when every configured RADIUS server rejects the credentials and failoverOnAuthenticationFailure is false. The message carries the username that failed RADIUS authentication.","triggerScenarios":"RadiusClient authentication against all configured servers returns failure; failoverOnAuthenticationFailure=false so instead of trying the next server the method aborts with FailedLoginException for that username.","commonSituations":"Wrong password entered at the CAS login page; RADIUS shared secret mismatch or wrong NAS IP causing server-side Access-Reject; user unknown to the RADIUS backend; only one server configured so 'failover' never has a next server.","solutions":["Verify the username/password credentials are correct against the RADIUS backend","Check the RADIUS shared secret, server host/port and NAS identifier in cas.authn.radius.* settings","Set failoverOnAuthenticationFailure=true (or add secondary servers) if transient rejects should fall over to another server","Inspect the RADIUS server logs for the Access-Reject reason"],"exampleFix":"// before\nthrow new FailedLoginException(\"Radius authentication failed for user \" + username);\n// after (config-level fix): cas.authn.radius.failover-authentication-failure=true\n// so RadiusUtils tries the next server instead of failing immediately","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    RadiusUtils.authenticateUsernamePassword(...);\n} catch (FailedLoginException e) {\n    LOG.warn(\"RADIUS rejected user {}\", username); // surface bad-credential UI\n} catch (Exception e) {\n    LOG.error(\"RADIUS transport failure\", e); // distinct retry path\n}","preventionTips":["Test shared secret and NAS config with radtest before pointing CAS at the server","Configure at least two RADIUS servers with failover enabled","Monitor RADIUS server reject logs"],"tags":["radius","authentication","cas"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}