Introduction to RADIUS

RADIUS (Remote Authentication Dial-In User Service) is a standard networking protocol used to centralize authentication, authorization, and accounting (AAA) for users and devices connecting to a network. Instead of every Wi-Fi access point or VPN gateway managing its own list of credentials, they all forward connection requests to a central RADIUS server, which decides whether to grant or deny access.

A typical RADIUS setup involves three parties:

• Client — the user or device trying to connect (e.g., a laptop joining corporate Wi-Fi).

• NAS (Network Access Server) — the access point, switch, or VPN gateway the client connects through. It acts as the RADIUS client, forwarding the request onward, (Example: a Cisco or Aruba Wi-Fi access point that a laptop connects to).

• RADIUS server — validates the request against an identity source and responds with Access-Accept or Access-Reject, optionally including additional instructions (Reply Attributes) for the NAS, such as which VLAN to place the device on.

RADIUS using OneIdP

RADIUS in OneIdP lets you authenticate users and devices connecting to your network infrastructure — Wi-Fi, VPN, or any RADIUS-capable NAS/access point — through a Scalefusion-hosted RADIUS server. This means you no longer need to run and maintain your own RADIUS infrastructure; you configure it once inside OneIdP and map it to your existing User Groups and Device Groups.

OneIdP RADIUS validates connection requests coming from a NAS (Network Access Server) or access point against identities managed in OneIdP — either directly (OneIdP users) or through your connected identity provider (Google LDAP, Active Directory, or Okta).

At a high level, authentication works like this:

1. A user or device connects to your Wi-Fi/VPN.

2. The NAS forwards the connection request to the Scalefusion RADIUS server.

3. RADIUS checks the identity against the User Group / Device Group mappings you've configured.

4. Credentials (and MFA, if enabled) are validated against the configured identity source.

5. RADIUS returns Success or Failed to the NAS, along with any configured Reply Attributes.

Organizations typically self-host and maintain their own RADIUS servers. OneIdP RADIUS removes that overhead by providing a Scalefusion-hosted RADIUS server that you configure and manage directly from OneIdP, using your existing User Groups, Device Groups, and identity providers.

Pre-requisites

Before you begin, make sure you have:

1. For User Group–based targeting: Users must already exist on the Scalefusion Dashboard and be a part of the user group alongside being onboarded as OneIdP users.

2. For Device Group–based targeting (EAP TLS only): devices must be actively enrolled in Scalefusion and assigned to a Device/User Group.

3. A configured identity source for the protocol you plan to use:

   1. EAP-TLS requires OneIdP users and/or devices with resolvable identities (email, IMEI, or serial number) in client certificates.

   2. EAP-TTLS (PAP), PEAP (MS-CHAP v2), and MS-CHAP v2 require each user's enrollment authentication source to be OneIdP, LDAP/Active Directory, Google(GLDAP) or Okta. SAML-based authentication sources are not supported for these protocols.

4. User Groups and/or Device Groups already created, since RADIUS configurations are mapped to groups rather than individual users or devices.

5. Admin access with the appropriate RADIUS permission under Roles and Permissions.

6. You have admin access to the NAS, access point, or VPN gateway you plan to connect.

7. A default / custom domain is created in OneIdP directory.

Supported Authentication Protocols

Note: For Wi-Fi, your network hardware needs to support the protocol you choose — EAP TLS, PEAP (MS CHAP v2), and EAP-TTLS (PAP) are the ones typically supported by Wi-Fi access points. For VPN, all of the protocols above are supported, since standard RADIUS authentication is used regardless of gateway vendor.