{"record":{"id":"e0425a5fab61ead1","repo":"apereo/cas","slug":"radius-authentication-failed-for-user-username-e0425a","errorCode":null,"errorMessage":"Radius authentication failed for user ${username}","messagePattern":"Radius authentication failed for user (.+?)","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-radius/src/main/java/org/apereo/cas/adaptors/radius/authentication/handler/support/RadiusAuthenticationHandler.java","lineNumber":63,"sourceCode":"        this.failoverOnException = failoverOnException;\n        this.failoverOnAuthenticationFailure = failoverOnAuthenticationFailure;\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,\n                                                                                        final String originalPassword) throws GeneralSecurityException {\n\n        try {\n            val username = credential.getUsername();\n            val result = RadiusUtils.authenticate(username, credential.toPassword(), this.servers,\n                this.failoverOnAuthenticationFailure, this.failoverOnException, Optional.empty());\n            if (result.getKey() && result.getValue().isPresent()) {\n                val attributes = CollectionUtils.toMultiValuedMap(result.getValue().get());\n                return createHandlerResult(credential,\n                    principalFactory.createPrincipal(username, attributes),\n                    new ArrayList<>());\n            }\n            throw new FailedLoginException(\"Radius authentication failed for user \" + username);\n        } catch (final Throwable e) {\n            LoggingUtils.error(LOGGER, e);\n            throw new FailedLoginException(\"Radius authentication failed \" + e.getMessage());\n        }\n    }\n}\n","sourceCodeStart":45,"sourceCodeEnd":70,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-radius/src/main/java/org/apereo/cas/adaptors/radius/authentication/handler/support/RadiusAuthenticationHandler.java#L45-L70","documentation":"In the classic RadiusAuthenticationHandler, when RadiusUtils.authenticateUsernamePassword reports failure (Pair key false) the handler throws FailedLoginException naming the user. This is the normal bad-credential path for RADIUS in CAS core authentication.","triggerScenarios":"authenticateUsernamePasswordInternal receives result.getKey()==false (or value absent) from RadiusUtils — all RADIUS servers rejected the username/password and failover did not apply.","commonSituations":"Wrong password at login; RADIUS shared secret/server misconfiguration; account rejected by RADIUS policy; secondary RADIUS servers not configured so failover silently fails.","solutions":["Verify the user's RADIUS credentials","Check cas.authn.radius server configuration (shared secret, host, authentication port, accounting port)","Configure multiple RADIUS servers and enable failoverOnAuthenticationFailure","Review RADIUS server logs for the reject reason"],"exampleFix":"// before\nthrow new FailedLoginException(\"Radius authentication failed for user \" + username);\n// after: enable failover so transient rejects retry\n// cas.authn.radius.failover-authentication-failure=true","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    authHandler.authenticate(credential);\n} catch (FailedLoginException e) {\n    // map to bad-credentials error in the login flow\n} catch (AccountNotFoundException e) {\n    // unknown user path\n}","preventionTips":["Verify RADIUS connectivity and secrets in a staging environment first","Enable failoverOnAuthenticationFailure with multiple servers","Log and correlate reject reasons with the RADIUS team"],"tags":["radius","authentication-handler","cas"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}