{"record":{"id":"fca607a52205082d","repo":"apereo/cas","slug":"failoveronexception-enabled-trying-next-server","errorCode":null,"errorMessage":"failoverOnException enabled -- trying next server.","messagePattern":"failoverOnException enabled -- trying next server\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-radius-core/src/main/java/org/apereo/cas/adaptors/radius/RadiusUtils.java","lineNumber":58,"sourceCode":"            LOGGER.debug(\"Attempting to authenticate [{}] at [{}]\", username, radiusServer);\n            try {\n                val response = radiusServer.authenticate(username, password, state);\n                if (response != null) {\n                    val attributes = response.attributes()\n                        .stream()\n                        .collect(Collectors.toMap(RadiusAttribute::getAttributeName, RadiusAttribute::getValue, (__, b) -> b, () -> new HashMap<String, Object>()));\n                    return Pair.of(Boolean.TRUE, Optional.of(attributes));\n                }\n\n                if (!failoverOnAuthenticationFailure) {\n                    throw new FailedLoginException(\"Radius authentication failed for user \" + username);\n                }\n                LOGGER.debug(\"failoverOnAuthenticationFailure enabled -- trying next server\");\n            } catch (final Exception e) {\n                if (!failoverOnException) {\n                    throw e;\n                }\n                LoggingUtils.warn(LOGGER, \"failoverOnException enabled -- trying next server.\", e);\n            }\n        }\n        return Pair.of(Boolean.FALSE, Optional.empty());\n    }\n}\n","sourceCodeStart":40,"sourceCodeEnd":64,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-radius-core/src/main/java/org/apereo/cas/adaptors/radius/RadiusUtils.java#L40-L64","documentation":"RadiusUtils.authenticate iterates over configured RADIUS servers. When a server throws an unexpected exception (network error, malformed response) and failoverOnException is enabled, the exception is swallowed with this warning and the next server is tried. If all servers fail, the method returns false with an empty response.","triggerScenarios":"A RADIUS server in the client list raises an exception during AccessRequest handling (timeout, connection reset, packet error) while the RadiusClient is configured with failoverOnException=true.","commonSituations":"Dead or unreachable secondary RADIUS servers; firewalls dropping UDP 1812 packets; wrong shared secrets causing protocol errors; mis-typed server addresses in cas.authn.radius.client.server settings.","solutions":["Fix the underlying RADIUS server error reported in the attached exception stack trace (host, port, shared secret).","Ensure at least one RADIUS server in the failover list is healthy so authentication can succeed.","If you'd rather fail fast and surface errors, set failoverOnException=false.","Verify network connectivity (UDP/1812) from the CAS host to each RADIUS server."],"exampleFix":"# before — every server fails silently\ncas.authn.radius.client.server[0].address=10.0.0.1:1812\ncas.authn.radius.client.server[1].address=10.0.0.2:1812\n# after — point at reachable servers and test connectivity\ncas.authn.radius.client.server[0].address=10.0.0.10:1812  # verify: nc -u -z 10.0.0.10 1812","handlingStrategy":"retry","validationCode":"nc -u -z radius01.example.org 1812 || echo 'RADIUS server unreachable'","typeGuard":null,"tryCatchPattern":"if (!authResult) {\n  // authenticate() returned Pair.of(false, empty) after all servers failed\n  logger.error(\"RADIUS authentication failed across all configured servers\");\n}","preventionTips":["Monitor each RADIUS server with periodic radtest health checks","Configure at least two geographically distinct RADIUS servers","Set failoverOnException=false when you need failures surfaced immediately"],"tags":["radius","failover","network"],"backgroundTag":"network-request-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}