Troubleshooting: Radius Denying All Users with Exception Getting User Factors Error

Version Affected: All
 
 

Overview

Remote Authentication Dial-In User Service (RADIUS) denies access for all users, with the RADIUS Server log showing an Exception getting User Factors error.

 

Cause

Incorrect Internet Information Services (IIS) Authentication settings on the RADIUS/API realm cause its API requests to be redirected to an HTML login page instead of returning the expected JSON response. The saRadiusServer log shows Exception getting User Factors for the query to the realm's api/v1/users endpoint, followed by the start of an HTML page rather than the expected JSON response.

The screenshot below shows this log entry, with the Exception getting User Factors message followed by HTML markup instead of a JSON response.

Resolution

On the IdP, open IIS Manager, expand Sites and Default Web Site, and select the RADIUS/API realm. Double-click Authentication and confirm the settings are:

• Anonymous Authentication = Enabled
• Forms Authentication = Enabled

The screenshot below shows the realm's Authentication settings in IIS Manager, with Anonymous Authentication and Forms Authentication both Enabled, and Basic and Windows Authentication both Disabled.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.