How To: Speed Up RADIUS Authentication for Users in 100+ AD Groups – SecureAuth Support

Version Affected: All

Overview

If users belong to 100 or more Active Directory groups, RADIUS authentication can be delayed -- not every RADIUS client can filter that much group data quickly enough, which can delay authentication or prevent the MFA screen or options from being presented at all.

Use a Primary VPN Group and Search Filter

Rather than relying on the client to filter every group a user belongs to, use a primary VPN group in AD (which can itself contain nested groups) together with a search filter and Group Filtering on the realm's Data tab. A well-formed search filter looks like this:

(&(samAccountName=%v)(objectclass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=VPN Groups,OU=Groups,DC=my,DC=corp))

This allows any member of VPN Groups -- including its nested groups -- to authenticate via the RADIUS server.

On the realm's Data tab:

Set searchFilter for your environment, as shown above.
Set User Groups to the primary VPN group.
Check Include Nested Groups.
Set Group Field to memberOf.
Set the Profile Field for Groups to memberOf.

The Data tab's Search Filter and Group Permissions sections, with numbered arrows pointing to searchFilter, User Groups, Include Nested Groups, Groups Field, and the Profile Fields Groups row, each set as described above.

Special Considerations

For additional search configurations and filters, see How To: Restrict Realm Login by Active Directory Group Using a Search Filter.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.