Skip to end of metadata
Go to start of metadata
Table of Contents

New CAS documentation site

Icon

CAS documentation has moved over to apereo.github.io/cas, starting with CAS version 4.x. The wiki will no longer be maintained. For the most recent version of the documentation, please refer to the aforementioned link.

RADIUS Authentication Handler

Including the Handler

In the pom.xml file for your CAS Maven2 WAR Overlay, add the following dependency:

Icon

For Version 4.0.0, implementation of this authentication handler has changed.

Core Classes

RadiusAuthenticationHandler

The RadiusAuthenticationHandler is the class that will take your credentials and authenticate them against a RADIUS server. It is able to handle two types of failovers: failover on an authentication failure, and failover on a server exception. It can be configured with the following properties:

  • failoverOnAuthenticationFailure - boolean to determine whether we should try the next server if there is an authentication failure.
  • failoverOnException - boolean to determine whether we should try the next server if an exception is thrown.
  • servers - takes an array of servers which are the RADIUS servers we would like to connect to. The handler tries them in the order they are configured.

JRadiusServerImpl

The JRadiusServerImpl is one implementation of the more generic RadiusServer interface. Its underlying implementation relies on the JRADIUS library.

Version 3.x:

Each instance represents one RADIUS server and has various configuration options:

  • accountingPort - the accounting port that this server uses.
  • authenticationPort - the authentication port this server uses.
  • radiusAuthenticator - the RADIUS authenticator to use. Defaults to PAP.
  • retries - the number of times to keep retrying a particular server.
  • sharedSecret - the secret key used to communicate with the server.
  • socketTimeout - the amount of time to wait before timing out.
  • hostName - the hostname of the RADIUS server.

Version 4.x:

Each instance represents an authentication-protocol-specific instance of a RADIUS server. Most configuration options have been delegated to the RadiusClientFactory, allowing you to use different authentication protocols on the same physical RADIUS server:

  • protocol - the authentication protocol this server uses.
  • clientFactory-Ref - the bean representing the RADIUS configuration options. 
  • retries - the number of times to keep retrying a particular server.

RadiusClientFactory (4.x)

The RadiusClientFactory implements RADIUS client-specific configuration options, representing a physical RADIUS server:

  • accountingPort - the accounting port that this server uses.
  • authenticationPort - the authentication port this server uses.
  • inetAddress - the hostname of the RADIUS server.
  • sharedSecret - the secret key used to communicate with the server.
  • socketTimeout - the amount of time to wait before timing out.

Configuration

Below, you'll find an example configuration for two RADIUS servers and failoverOnException. This authenticationHandler is configured within the "authenticationHandlers" property of the AuthenticationManagerImpl. Usually, it would replace the test authentication handler.

CAS version 3.x

Below, you'll find a CAS 4.0 example configuration for two RADIUS servers with different authentication protocols and failoverOnException. This authenticationHandler is configured alongside the PolicyBasedAuthenticationManager  and referenced as an entry inside its map:

CAS version 4.0

Supported RADIUS authentication protocols

RADIUS support enables the following RADIUS authentication protocols:

  • CHAP
  • EAP-MD5
  • EAP-MSCHAPv2
  • MSCHAPv1
  • MSCHAPv2
  • PAP (default)

 

Extended RADIUS protocol support in CAS 4.0.0

Icon

RADIUS support in CAS 4.0.0 was overhauled and now enables the use of several additional protocols. The list of additional protocols is limited due to some JRADIUS library restrictions:

  • EAP-TTLS with PAP
  • EAP-TTLS with EAP-MD5
  • EAP-TTLS with EAP-MSCHAPv2
  • PEAPv0 with EAP-MSCHAPv2

Although adding the JRADIUS Extended dependency also enables support for EAP-TLS, its protocol support is untested.

To enable extended protocol use in CAS, add the following dependency in the pom.xml file for your CAS Maven2 WAR Overlay:

  • No labels