Understanding the Radius Logs

Activity logs

RADIUS configuration changes are recorded under OneIdP > Activity Report, in a RADIUS Configuration category, covering:

• Configuration created

• Configuration modified

• Configuration deleted

• Configuration assigned to a group

• Configuration unassigned from a group

Each entry records the admin who performed the action.

RADIUS Logs

To view Authentication events:

1. Go to OneIdP > RADIUS > RADIUS Logs.

2. Use the filters to narrow results: configuration, NAS IP address, user/email, authentication protocol, status (Success/Failed), and date range.

3. Click any log entry to view access details, Identity provider details, the MFA result, and the Reply Attributes applied during that authentication.

4. Click Download Logs to export the currently filtered results as CSV. This is available only to admins with All access to RADIUS.

Reviewing Log Details

Administrators can view the high-level authentication Status (Success or Failed) directly from the main RADIUS Logs table.

To investigate a specific authentication attempt, click the action button alongside any log entry to open the Log Details panel. This panel provides a comprehensive breakdown of the transaction, divided into three key areas:

• Access Details: Displays the exact User/Device Identifier, NAS IP, Authentication Protocol, Date & Time, the final Status, and the specific Failure Reason (if the connection was rejected).

• Identity Provider Details: Shows the Identity Provider used, whether the primary credential check succeeded (IdP Result), and the status of the Multi-Factor Authentication check (OneIdP MFA Result).

• RADIUS Reply Attributes: Lists any configuration or group-level attributes passed back to the NAS upon a successful connection.

Example 1: Failed Authentication Log

In the failure example above, the primary identity check (IdP Result) succeeded, but the connection was ultimately rejected because the user provided an "Invalid OTP / TOTP" during the MFA check.

Example 2: Successful Authentication Log

1. In this successful EAP-TLS example, access is granted without errors.

2. Because EAP-TLS relies entirely on secure client certificates rather than passwords, the MFA result correctly registers as "Not Applicable," and the Failure Reason is "N/A."

OneIdP MFA Result values

When MFA is involved, the log entry's OneIdP MFA Result shows one of the following:

Understanding Failure Reasons

Invalid Authentication Protocol

1. What it means: The user tries to connect to Wi-Fi using an authentication protocol that is not enabled or checked in the target RADIUS configuration.

2. What to do: Re-check the RADIUS configuration on the Scalefusion Dashboard and ensure the protocol being used by the device is checked/enabled.

Certificate verification failed

1. What it means: The client certificate presented by the device does not match the Client CA Certificate uploaded in radius configuration.

2. What to do: Re-check both the client certificate CA and the Root CA certificate.

User is not assigned to any published user group for this RADIUS configuration

1. What it means: The user authenticated correctly with valid credentials, but they are not in a User Group that RADIUS configuration is published to.

2. What to do: Add the user to a published User Group, or publish the configuration to their existing group.

Device is not assigned to a device group published to this RADIUS configuration

1. What it means: During EAP-TLS authentication, the device is enrolled, but it is not part of any Device Group to which the RADIUS configuration has been published.

2. What to do: Add the device to the correct, published Device Group.

Device is not enrolled in Scalefusion

1. What it means: The device attempted an EAP TLS authentication without an active Scalefusion enrollment record.

2. What to do: Enroll the device into Scalefusion before granting RADIUS access.

User Account is locked

1. What it means: The user's OneIdP account has been automatically or manually locked (e.g., due to excessive failed attempts).

2. What to do: Check if user’s account is locked.

User Account is not allowed to access the app

1. What it means: The user is currently in a soft-deleted or domain of the user is not verified on the dashboard.

2. What to do: Check the user's status on the dashboard and reactivate them if necessary.

Network access not activated for this account

1. What it means: This issue occurs during PEAP-MSCHAPv2 or MSCHAPv2 authentication when the user has not activated the Network Access sent to their registered email address.

2. What to do: Confirm with the user whether they've clicked and activated network access via the link emailed to them, or have them log into the User Portal/Keycard/SSO.

The configured authentication source does not support network access via OneIdP RADIUS

1. What it means: The user's authentication source isn't one that supports credential verification for RADIUS (e.g., they are using a SAML-based identity provider).

2. What to do: Verify the user's identity provider supports password validation via OneIdP (must be OneIdP, LDAP, AD, or Okta API).

Multi-factor authentication is required but not configured

1. What it means: MFA is enabled on the RADIUS configuration, but it is not enabled for this specific user at the Directory level.

2. What to do: Enable MFA at the Directory level and ensure the user has set up a compatible authenticator app.

Invalid username or password

1. What it means: The primary credentials entered were incorrect.

2. What to do: Have the user re-enter their credentials carefully or reset their password.