RADIUS vs LDAP for Network Authentication

RADIUS (Remote Authentication Dial-In User Service) is a client-server protocol defined in RFC 2865 (and updated by RFC 2866 for accounting). It provides centralized Authentication, Authorization, and Accounting (AAA) for network access. It was originally designed for dial-up connections but is now used for VPNs, wireless LANs (802.1X), and network device administration.

RADIUS operates at the application layer (UDP ports 1812 for authentication/authorization, 1813 for accounting; older implementations use ports 1645/1646). It is a stateless protocol—each request is independent. The RADIUS client (often a Network Access Server, NAS, like a wireless controller or VPN concentrator) sends user credentials to the RADIUS server, which responds with an accept, reject, or challenge.

The process follows these steps: 1. A user attempts to connect to a network resource (e.g., Wi-Fi access point). 2. The NAS (RADIUS client) prompts for credentials. 3. The NAS sends an Access-Request packet to the RADIUS server. This packet contains the username, password (encrypted using a shared secret), NAS identifier, and other attributes like calling-station-id. 4. The RADIUS server checks the credentials against its database (or forwards to an external identity source like LDAP). 5. The server responds with:

- Access-Accept: user is authenticated and optionally includes authorization attributes (e.g., VLAN assignment, ACL name). - Access-Reject: user is denied. - Access-Challenge: server requests additional verification (e.g., OTP token). 6. The NAS enforces the decision and logs accounting data (start, interim, stop) to the RADIUS accounting server.

Key attributes in RADIUS packets include:

RADIUS uses a shared secret (pre-shared key) between client and server to encrypt passwords and authenticate packet integrity. The secret is never sent over the wire; it is used to create an MD5 hash of the password.

LDAP (Lightweight Directory Access Protocol) is an open, vendor-neutral protocol defined in RFC 4511 for accessing and maintaining distributed directory information services over an IP network. It is a lightweight version of the older X.500 DAP protocol. LDAP runs over TCP port 389 (plain) or port 636 (LDAPS, LDAP over SSL/TLS).

LDAP directories are hierarchical databases that store information about users, groups, devices, and other resources. Common LDAP directories include Microsoft Active Directory, OpenLDAP, and Novell eDirectory.

LDAP uses a client-server model where the client (application) sends LDAP messages to the server. The basic operations are:

An LDAP directory is organized as a tree (Directory Information Tree, DIT). Entries have a Distinguished Name (DN) that uniquely identifies them, e.g., cn=John Doe,ou=Users,dc=company,dc=com. Attributes within entries store data like uid, mail, userPassword.

For authentication, an application (e.g., a web app) performs an LDAP bind with the user's DN and password. The server verifies the password (usually by comparing against the stored hash) and returns success or failure. LDAP does not provide authorization attributes like VLAN or ACL—it just confirms identity. Authorization must be implemented by the application based on directory attributes (e.g., group membership).

In many enterprises, RADIUS servers are configured to use an LDAP directory as the identity source. The RADIUS server (e.g., Cisco ISE, FreeRADIUS) receives an Access-Request, then performs an LDAP bind with the user's credentials to verify them. If successful, it may also query LDAP for group membership to assign authorization attributes (e.g., VLAN based on group). This combines the AAA strengths of RADIUS with the centralized user management of LDAP.

Cisco IOS RADIUS configuration:

radius server RADIUS_SERVER
 address ipv4 192.168.1.10 auth-port 1812 acct-port 1813
 key MySecretKey
!
aaa new-model
aaa authentication login default group radius local
aaa authorization network default group radius
aaa accounting exec default start-stop group radius

OpenLDAP search example:

ldapsearch -x -H ldap://ldap.example.com -b "dc=example,dc=com" "(uid=jdoe)"

FreeRADIUS LDAP module (raddb/mods-enabled/ldap):

ldap {
 server = 'ldap.example.com'
 identity = 'cn=admin,dc=example,dc=com'
 password = 'adminpass'
 base_dn = 'dc=example,dc=com'
}

Scenario 1: Enterprise Wi-Fi with 802.1X

A large corporation uses Cisco ISE (Identity Services Engine) as its RADIUS server for WPA2-Enterprise Wi-Fi. Employees connect with their domain credentials. The wireless LAN controller (WLC) is the RADIUS client. When an employee connects, the WLC forwards EAP-TLS (certificate-based) or PEAP-MSCHAPv2 (password-based) authentication to ISE. ISE authenticates against Active Directory (LDAP) and then applies authorization policies: if the user is in the 'Engineering' group, they get VLAN 100; if in 'Guest', they get VLAN 200 with internet-only access. ISE also performs posture checks (e.g., antivirus status) via RADIUS CoA (Change of Authorization) to dynamically change ACLs. Common issues: misconfigured shared secrets cause authentication failures; LDAP timeouts if the directory server is overloaded; RADIUS packets dropped due to UDP unreliability (solved by adding multiple RADIUS servers).

Scenario 2: VPN Remote Access

A company uses a Cisco ASA firewall as a VPN concentrator. Remote users authenticate via RADIUS to a FreeRADIUS server that uses an OpenLDAP directory. The LDAP directory stores user attributes like 'radiusVLAN' and 'radiusSessionTimeout'. FreeRADIUS is configured to query LDAP for these attributes after authentication. The VPN assigns IP addresses from a pool and applies ACLs based on the returned attributes. Performance: each authentication takes ~50ms with LDAP on the same LAN; with WAN latency, it can exceed 200ms. Timeouts are configured (e.g., 5 seconds for LDAP bind). If LDAP is down, RADIUS can fall back to a local database.

Scenario 3: Network Device Administration

Network administrators log into routers and switches using RADIUS for AAA. The devices (RADIUS clients) send authentication requests to a RADIUS server that authenticates against LDAP. Authorization is handled by RADIUS attributes: for example, Cisco AV-pairs like 'shell:priv-lvl=15' grant full privilege. Accounting logs all commands entered. Common misconfigurations: RADIUS server IP not allowed in the device's RADIUS server list; shared secret mismatch; LDAP schema missing required attributes. Scale: a single RADIUS server can handle thousands of authentications per second; LDAP queries can be cached to reduce load.